EUVD-2026-81861

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

CVE-2026-90268 scsi: sd: Fix error handling in sd_probe() after large pool creation failure

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

CVE-2026-90268

CVE-2026-90268 is a memory management flaw in the Linux kernel 's SCSI sd driver. In sd_probe(), when sd_large_pool_create() fails after device_add(&sdkp->disk_dev) has already succeeded, the error path incorrectly calls kfree() on an already-registered device instead of unregistering it via s...

tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API

A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication formerly JASPIC ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process...

tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API

A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication formerly JASPIC ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process...

tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API

A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication formerly JASPIC ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process...

CVE-2026-54471

Dell SmartFabric Manager versions prior to 2.2.1 are susceptible to an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could exploit this flaw to cause Information disclosure . No specific technical root cause details, exploi...

CVE-2026-54471

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

EUVD-2026-81674

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

DEBIAN-CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

BIT-MONGODB-2026-82053 Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

CVE-2026-25280

Memory corruption when processing escape handling flow with insufficient user buffer sizes...

EUVD-2026-81327

Memory corruption when processing escape handling flow with insufficient user buffer sizes...

CVE-2026-25280 Out-of-bounds Write in DSP Service

Memory corruption when processing escape handling flow with insufficient user buffer sizes...

CVE-2026-25280 Out-of-bounds Write in DSP Service

Memory corruption when processing escape handling flow with insufficient user buffer sizes...

CVE-2026-25280

CVE-2026-25280 is an out-of-bounds write (memory corruption) in the Qualcomm DSP Service , triggered by the escape handling flow when insufficient user buffer sizes are present. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector , low privileges required, and no u...

PT-2026-94928

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ACPI subsystem for RISC-V architectures within the riscv acpi add prt dep function. The loop handling within this function incorrectly manages error conditions by...

Ubuntu 26.04 LTS : libheif vulnerabilities (USN-8774-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8774-1 advisory. Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute...