EUVD-2026-92017

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105113

The Nezha Dashboard (versions 1.8.0 before 2.3.13) is vulnerable to an improper locking issue (CWE-667). The root cause is a non-deferred mutex unlock that leaks during a nil-map panic path . An authenticated non-admin member can trigger this by making four specific notification API calls, result...

EUVD-2026-92016

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-105112

The Nezha monitoring agent, versions 1.8.0 before 2.3.13 , is vulnerable to a lock-order inversion within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated non-admin users to trigger a deadlock in the alerting subsystem . By concurrently calling the notification-group and ...

GhostLock-GOT-W29

CVE-2026-43499 GhostLock — HUAWEI MatePad Pro 11 GOT-W29 Исследование повышения привилегий для CVE-2026-43499 UAF стека rtmutex/futex-PI, "GhostLock" на GOT-W29 HarmonyOS 4.0, ядро 4.19.157-perf+. Итоговые выводы 1. Уязвимость реальна и воспроизводима : удержание значения в PI-кольце заставляет...

CLEANSTART-2026-CH08706 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

sweyntooth_bluetooth_low_energy_attacks

SweynTooth — выпуская хаос в Bluetooth Low Energy Этот репозиторий является частью результатов исследованияASSET Research Group. SweynTooth охватывает семейство из 18 уязвимостей в различных наборах средств разработки SDK Bluetooth Low Energy BLE от шести крупных производителей систем-на-кристалл...

CVE-2026-36957

CVE-2026-36957: Boa WebサーバーへのHTTPフラッドによるサービス拒否 CVE ID: CVE-2026-36957 日付: 2026-04-29 発見者: Kirubel Solomne ベンダー: 深センDibit網絡設備有限公司 Shenzhen Dibit Network Equipment Co., Ltd. 製品: Dbit Router ファームウェアバージョン: V1.0.0 CWE: CWE-400 - 制御されないリソース消費 説明 Dbit RouterファームウェアV1.0.0は、Boa...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

SUSE-SU-2026:4408-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST reque...

CLEANSTART-2026-WT03886 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the kube-state-metrics-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.6:CLSA-2026:1779182426)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779182426 advisory. - If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock,...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory. - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789898700)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789898700 advisory. - In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when holding Fwb to get inlinedat...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2026_3463)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20263463 advisory. kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration CVE-2026-23097 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crxsa-2024_6567)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crxsa-20246567 advisory. kernel: efivarfs: force RO when remounting if SetVariable is not supported CVE-2023-52463 kernel: nfsd: fix RELEASELOCKOWNER CVE-2024-26629 kernel: mm:...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory. - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the seria...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2025_2473)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20252473 advisory. kernel: HID: core: zero-initialize the report buffer CVE-2024-50302 kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox device...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2025_2474)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20252474 advisory. kernel: HID: core: zero-initialize the report buffer CVE-2024-50302 kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox device...

Rocky Linux 9 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-64k / kernel-64k-core / etc Multiple Vulnerabilities (crlsa-2024_6567)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246567 advisory. kernel: efivarfs: force RO when remounting if SetVariable is not supported CVE-2023-52463 kernel: nfsd: fix RELEASELOCKOWNER CVE-2024-26629 kernel: mm:...