232405 matches found
CVE-2026-74369
A flaw was found in the Linux kernel's liveupdate component. This use-after-free vulnerability occurs due to an incorrect order of operations when managing file handler modules. Specifically, the system attempts to access module operations after the module's reference count has been decremented,...
Vulnerabilities in Oracle Commerce Platform
Oracle has identified several vulnerabilities in the Oracle Commerce Platform version 11.4.0. These vulnerabilities allow unauthorized attackers with network access to perform critical actions without authentication. This includes gaining unauthorized access to sensitive data, modifying, deleting...
GHSA-XPMJ-WJCP-6PWW
creationtimestamp| type| source ---|---|--- 2026-08-19 09:32:00+00:00| seen| https://gist.github.com/alon710/f8eaee2020ed8f819add6f9d1de77bf8...
BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...
CVE-2026-58087
The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...
CVE-2026-58087 Heap out-of-bounds access in semctl(2)
The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...
CVE-2026-74356
A flaw was found in the Linux kernel's vhost subsystem. An incorrect return value from the vhostgetavailidx function can cause the host to livelock. A malicious guest operating system OS can exploit this by not processing virtqueue entries, leading to the host repeatedly disabling notifications a...
EUVD-2026-62338
To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...
CVE-2026-58084 Kernel stack disclosure via timer_settime(2)
To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...
CVE-2026-49428
Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...
CVE-2026-49430
The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...
CVE-2026-49422
The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...
CVE-2026-49428 posixshm: system calls can incorrectly free memory of largepage objects
Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...
CVE-2026-49428
FreeBSD is vulnerable to a flaw in its posixshm module involving largepage shared memory objects. Specifically, certain system calls such as open(2) with the O_TRUNC flag and fspacectl(2) fail to verify that these operations are prohibited on largepage objects, leading to the incorrect freeing of...
CVE-2026-49428 posixshm: system calls can incorrectly free memory of largepage objects
Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...
EUVD-2026-62255
Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...
CVE-2026-49427
The FreeBSD kernel's posixshm module contains a vulnerability where pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmits such an object with the SF_NOCACHE flag, it incorrectly frees the underlying pages while existing mappings still refer to th...
EUVD-2026-62254
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...