CVE-2026-58092

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

CVE-2026-58091

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

CVE-2026-58092 Unauthorized credential switching

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

EUVD-2026-66237

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

CVE-2026-58092 Unauthorized credential switching

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

CVE-2026-58091 Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

EUVD-2026-66236

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098740)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098740 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a point...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093649)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093649 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are 5.7.33 and prior and...

PT-2026-82154

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where the xfs rtginode ensure function incorrectly handles errors from xfs rtginode load. Specifically, it treats all errors except -ENOENT as...

PT-2026-81929

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

PT-2026-81930

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...

PT-2026-82133

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where perf event open accepts events in the EXIT state as group leaders because early validation only rejects REVOKED and DEAD events. This occurs aft...

Linux Distros Unpatched Vulnerability : CVE-2026-74753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-061547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061547 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are 5.7.37 and prior and...

GO-2026-6256 BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit

BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit...

BIT-KEYCLOAK-2026-15945 Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

BIT-KEYCLOAK-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

BIT-KEYCLOAK-2026-9099 Keycloak: group-admin escalation to realm-admin

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 FGAPv2 is enabled, an attacker wi...

BIT-KEYCLOAK-2026-14615 Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a...