CVE-2026-80892 erofs: cap LZMA stream pool size

In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressorlzma.c sizes the module-global MicroLZMA stream pool from numpossiblecpus when the lzmastreams module parameter is unset, then zerofsloadlzmaconfig preallocates one...

CVE-2026-82367

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

CVE-2026-82367 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

EEF-CVE-2026-82367 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Summary Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved...

CVE-2026-82367

CVE-2026-82367 is a re-entrant data-exposure bug in ash_graphql (ash-project), affecting versions 1.4.0 through before 1.11.0 . The root cause lies in AshGraphql.Subscription.Batcher.do_send/5, which reads and deletes the process-dictionary key :batch_resolved without namespacing it per run. On t...

EUVD-2026-66245

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file...

CVE-2026-76149

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file...

CVE-2026-76149

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file...

CVE-2026-76149

CorvusSKK , a Japanese input method editor, contains an integer overflow vulnerability that may allow malicious data to be written to a dictionary file . The attack vector is local with user interaction required (no privileges needed), resulting in low integrity and availability impact and no con...

CVE-2026-76149

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file...

Astra Linux – Vulnerability in Redis

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command specifically, a SET command. NOTE: this issue was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have any safety guarantees related to...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. The QuerySet.annotate, aggregate, and extra methods are vulnerable to SQL injection when column aliases are used, through a crafted dictionary with dictionary expansion as part of the kwargs parameters...

Astra Linux – Vulnerability in Linux 5.15

A vulnerability has been identified in the ksmbd component of the Linux kernel the kernel SMB/CIFS server. A security measure designed to prevent dictionary attacks—which introduces a 5-second delay during session setup—can be bypassed through the use of asynchronous requests. This bypass defeats...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...

Astra Linux – Vulnerability in libpodofo

A stack-based buffer overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service through the ‘src/base/PdfDictionary.cpp:65’ component...

Linux Distros Unpatched Vulnerability : CVE-2026-77220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the...

DEBIAN-CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

CVE-2026-77220 PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...