CVE-2026-8497

CVE-2026-8497 describes an issue in Devolutions Password Manager (versions up to 2026.2.1.0) where Devolutions Server connection handling performs improper certificate validation on Android, iOS, and macOS. This allows an adjacent-network attacker to intercept and modify sensitive information thr...

CVE-2026-54705

This CVE concerns MathLive web components (pre-0.110.0) where text-mode content in parts of Box.toMarkup (src/core/box.ts), xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, as well as through convertLatexToMarkup, convertLatexToMathMl, , , and the default identity Math...

CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-64306

A flaw was found in the Linux kernel's Cryptographic API, specifically within the Counter Mode Deterministic Random Bit Generator CTRDRBG. The drbgctrgenerate function can incorrectly indicate a successful operation even when it has failed. This issue results in the output buffer remaining...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-64461

A flaw was found in the Linux kernel's MediaTek PCIe driver. When a Peripheral Component Interconnect Express PCIe port fails to enable, the associated Interrupt Request IRQ domains are not properly released. This resource leak can accumulate over time, potentially leading to a denial of service...

CVE-2026-64376

A flaw was found in the Linux kernel's firmware loader component. This vulnerability occurs in the firmwareuploadregister function when an allocation failure happens after a device instance is created. The system fails to properly release a device reference, leading to an unbalanced reference...

CVE-2026-42792

A flaw was found in Erlang OTP's Erlang Port Mapper Daemon epmd. An unauthenticated remote attacker can exploit an improper handling of exceptional conditions in the doaccept function. By exhausting connection slots through holding numerous TCP connections open and periodically sending data, the...

UBUNTU-CVE-2026-18220

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend bfd/elf32-dlx.c in GNU binutils. The dlxrtypetohowto function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values via...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

UBUNTU-CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100

Apache Traffic Server HPACK issue: the encoder updates its dynamic table before the header block is confirmed, causing desynchronization with the decoder after a failed encode. This can corrupt subsequent header blocks on a connection. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. ...

CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

EUVD-2026-50235

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-64297

A flaw was found in the Linux kernel. An unchecked return value in the moduleextendmaxpages function within the module decompression logic can lead to a null pointer dereference. This vulnerability can be triggered if memory allocation fails during module loading, resulting in a kernel oops. This...

The vulnerability of the __folio_split() function in the mm/huge_memory.c module of the Linux kernel’s memory management subsystem allows a hacker to trigger a system failure.

The vulnerability of the foliosplit function in the mm/hugememory.c module of the Linux kernel’s memory management subsystem is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

PT-2026-65695

The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A...