CVE-2026-13075

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

CVE-2026-13075 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

CVE-2026-13075

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

EUVD-2026-47786

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

SUSE-SU-2026:22810-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2026-31503: udp: Fix wildcard bind...

CVE-2026-55991

CVE-2026-55991 affects NLnet Labs Unbound 1.22.0–1.25.1. A remote unauthenticated DoQ client can trigger a libngtcp2 assertion by passing an erroneous error value when ngtcp2_conn_writev_stream() returns NGTCP2_ERR_STREAM_DATA_BLOCKED and Unbound calls ngtcp2_ccerr_set_application_error() with -1...

CVE-2026-55991 Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

EUVD-2026-47683

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

PT-2026-63479

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

CVE-2026-63986

A flaw was found in the Linux kernel's ethtool: tsinfo component. This vulnerability occurs when the ethnltsinfopreparedump function fails to properly initialize a generic netlink message genlmsg but still attempts to cancel it by passing an error pointer. This improper error handling can lead to...

SUSE CVE-2026-53379

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov8856: free control handler on error in ov8856initcontrols The control handler wasn't freed if adding controls failed, add an error exit label and convert the existing error return to use it...

SUSE CVE-2026-64060

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfswritebegin error handling Fix netfswritebegin to not leak our ref on the request in the event that we get an error from netfswaitforread...

SUSE CVE-2026-64144

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix urb-setuppacket leak in error paths The setuppacket of control urb is not freed if usbsubmiturb fails or the submitted urb is killed. Add free in these two paths...

SUSE CVE-2026-64148

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...

SUSE CVE-2026-64153

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...

CVE-2026-64040

A flaw was found in the Linux kernel's cachefiles subsystem. When the vfsmkdir function fails, the system does not correctly extract the error code from the returned error pointer. This improper handling can lead to a null pointer being returned instead of a valid error, potentially causing a...

CVE-2026-64060

A flaw was found in the netfs component of the Linux kernel. An issue in the error handling of the netfswritebegin function can lead to a leak of a request resource. This occurs when an error is returned from netfswaitforread, preventing the proper release of the resource. This resource leak may...

CVE-2026-53379

A flaw was found in the Linux kernel's ov8856 media driver. This vulnerability occurs due to improper error handling where a control handler is not correctly released if an error occurs during its initialization. This oversight could potentially lead to resource exhaustion, which may result in a...

CVE-2026-64205

A flaw was found in the Linux kernel's i2c-i801 driver. This vulnerability allows a local attacker to trigger a hardware state machine corruption during error handling. This can lead to a denial of service DoS, where the system becomes unresponsive due to a continuous stream of error messages and...

GHSA-W8WR-V893-VJVP node-tar: Process crash via PAX numeric path type confusion

Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...