EUVD-2026-92017

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105113

The Nezha Dashboard (versions 1.8.0 before 2.3.13) is vulnerable to an improper locking issue (CWE-667). The root cause is a non-deferred mutex unlock that leaks during a nil-map panic path . An authenticated non-admin member can trigger this by making four specific notification API calls, result...

EUVD-2026-92016

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-105112

The Nezha monitoring agent, versions 1.8.0 before 2.3.13 , is vulnerable to a lock-order inversion within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated non-admin users to trigger a deadlock in the alerting subsystem . By concurrently calling the notification-group and ...

GhostLock-GOT-W29

CVE-2026-43499 GhostLock — HUAWEI MatePad Pro 11 GOT-W29 针对 GOT-W29（HarmonyOS 4.0, kernel 4.19.157-perf+）上 CVE-2026-43499 （rtmutex/futex-PI 栈 UAF，"GhostLock"）的提权研究。 最终结论 1. 漏洞真实且可触发 ：值持有 PI 环使 FUTEXCMPREQUEUEPI 返回 -EDEADLK， 回滚路径激活 removewaiter 的 current != waiter-task 清理 bug（本内核...

CLEANSTART-2026-CH08706 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

CVE-2026-56855 affects multiple packages. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

sweyntooth_bluetooth_low_energy_attacks

SweynTooth - 在低功耗蓝牙上制造混乱 本仓库是ASSET Research Group 研究成果的一部分。 SweynTooth 涵盖六大主要片上系统（SoC）厂商的不同低功耗蓝牙（BLE）软件开发套件（SDK）中的一系列 18 个漏洞 。这些漏洞暴露了特定 BLE SoC 实现中的缺陷，使无线电范围内的攻击者能够根据具体情况触发死锁、崩溃 和缓冲区溢出 ，或完全绕过 安全防护 。（更新）我们还加入了一个测试脚本，用于检查设备是否受 BLE KNOB 变体影响 。 你可以在 ASSET Research Group SweynTooth 披露网站 上查看有关这些漏洞、可用补丁...

CVE-2026-36957

CVE-2026-36957：Boa Web 服务器因 HTTP 洪泛攻击导致拒绝服务 CVE ID： CVE-2026-36957 日期： 2026-04-29 发现者： Kirubel Solomne 厂商： 深圳市迪比特网络设备有限公司 产品： Dbit 路由器 固件版本： V1.0.0 CWE： CWE-400 - 未受控的资源消耗 描述 Dbit 路由器固件 V1.0.0 存在通过 Boa Web 服务器 URI 处理器导致的拒绝服务漏洞。攻击者向不存在的 URI 发送大量 HTTP GET...

AnyIO process-pool workers can block indefinitely on undrained stderr

ImpactAnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code th...

SUSE-SU-2026:4408-1 Security update for alloy

This update for alloy fixes the following issues: - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST reque...

CLEANSTART-2026-WT03886 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the kube-state-metrics-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory. - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the...

Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.6:CLSA-2026:1779182426)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779182426 advisory. - If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock,...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2026_3463)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20263463 advisory. kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration CVE-2026-23097 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crxsa-2024_6567)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crxsa-20246567 advisory. kernel: efivarfs: force RO when remounting if SetVariable is not supported CVE-2023-52463 kernel: nfsd: fix RELEASELOCKOWNER CVE-2024-26629 kernel: mm:...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789898700)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789898700 advisory. - In the Linux kernel, the following vulnerability has been resolved: ceph: fix possible deadlock when holding Fwb to get inlinedat...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2025_2473)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20252473 advisory. kernel: HID: core: zero-initialize the report buffer CVE-2024-50302 kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox device...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786352940)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786352940 advisory. - In the Linux kernel, the following vulnerability has been resolved: serial: imx: fix tx statemachine deadlock When using the seria...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2025_2474)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20252474 advisory. kernel: HID: core: zero-initialize the report buffer CVE-2024-50302 kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox device...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_3488)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263488 advisory. kernel: smc: Use skdstget and dstdevrcu in smcclcprfxmatch CVE-2025-40168 kernel: ipv6: BUG in pskbexpandhead as part of calipsoskbuffsetattr CVE-2025-7108...