CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-19012

A flaw was found in Consul. An authenticated attacker with config-entry write permission can exploit a vulnerability in the Enterprise-to-Community Edition downgrade path. By submitting a specially crafted service-router configuration entry, the attacker can cause the Consul server agent to exit...

MINI-M7MQ-5HVX-89QW

Bulletin has no description...

CVE-2026-72742

creationtimestamp| type| source ---|---|--- 2026-08-12 18:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvphplvqo2n...

PT-2026-71136

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...

MINI-7FCJ-XCVH-JXQ9

Bulletin has no description...

CVE-2026-68100

A flaw was found in ksmbd in the Linux kernel. An authenticated client can provide a crafted security descriptor that is not properly validated when copying Access Control Entries ACEs in the setntacldacl function. This improper validation leads to an out-of-bounds heap read, allowing the client ...

CVE-2026-68172

A flaw was found in the Linux kernel, specifically within the hugeptepget helper function for the arm64 architecture. When this function is provided with an unaligned virtual address, it can incorrectly process Page Table Entries PTEs. This can lead to the kernel dereferencing invalid memory...

MINI-7RGM-8W8H-F45G

Bulletin has no description...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

CVE-2026-72909 ERPNext: Broken Access Control on certain endpoints

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72909 ERPNext: Broken Access Control on certain endpoints

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72863

creationtimestamp| type| source ---|---|--- 2026-08-10 19:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqthb3xrx2q...

CVE-2026-68417

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...

CVE-2026-68324

In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmarlatencydisable dmarlatencydisable intends to zero out only the single latencystatistic entry for the given type, but the memset size was computed as sizeoflstat DMARLATENCYNUM, which...

CVE-2026-68171

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-68163

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

UBUNTU-CVE-2026-68200

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

UBUNTU-CVE-2026-68163

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...