CVE-2026-106433

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106433

Improper state management in MongoDB libmongocrypt allows for heap corruption when cleaning up a key document that contains duplicate masterKey fields. This flaw causes provider-specific data to be treated as an incompatible type, leading to invalid memory access and invalid frees in the client p...

CVE-2026-25589-25588-25243-23631-23479-REDIS

Redis 5件のCVEに対するテスト・修正ガイド（2026.05.08時点） 公開日: 2026-05-08 著者: TonyCao [email protected] 出典: Redis Security Advisory 目次 1. 概要 2. 影響を受けるバージョン 3. 各CVEの詳細 CVE-2026-23479 — Unblock Client FlowにおけるUse-after-free CVE-2026-25243 — RESTOREにおけるInvalid Memory Access CVE-2026-25588 — RedisTimeSeries...

DEBIAN-CVE-2026-104039

A flaw was found in SSSD. A local user can cause a denial of service DoS by disrupting system authentication services. When handling Generic Security Services Application Programming Interface GSSAPI authentication in the Pluggable Authentication Module PAM responder, cached connection state is...

CVE-2026-104039

A flaw was found in SSSD. A local user can cause a denial of service DoS by disrupting system authentication services. When handling Generic Security Services Application Programming Interface GSSAPI authentication in the Pluggable Authentication Module PAM responder, cached connection state is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed an invalid prog-stats access when updateeffectiveprogs fails. The issue occurs due to a fault-injected code sequence in updateeffectiveprogs. The problem can be described as follows: c cgroupbpfdetach...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: hwmon: In the readstring function, the sensor index is checked. This prevents potential invalid memory accesses when the requested sensor is not found. findecsensorindex may return a negative value e.g., -ENOENT, but its result w...

UBUNTU-CVE-2026-104855

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epochdeadlinecallback or continues...

CVE-2026-104855

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epochdeadlinecallback or continues...

Rocky Linux 10.2 [CIQ] Security Update: valkey / valkey-debuginfo / valkey-debugsource / valkey-devel Multiple Vulnerabilities (crlsa-2026_25216)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625216 advisory. redis: use-after-free in unblock client flow may allow remote code execution CVE-2026-23479 redis: Remote code execution via use-after-free in Lua...

Rocky Linux 9 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2026_25219)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625219 advisory. redis: use-after-free in unblock client flow may allow remote code execution CVE-2026-23479 redis: Remote code execution via use-after-free in Lua scripti...

Rocky Linux 8 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc (crlsa-2026_26008)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626008 advisory. redis: RESTORE invalid memory access may allow remote code execution CVE-2026-25243 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: valkey / valkey-debuginfo / valkey-debugsource / valkey-devel Multiple Vulnerabilities (crlsa-2026_25925)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625925 advisory. redis: use-after-free in unblock client flow may allow remote code execution CVE-2026-23479 redis: Remote code execution via use-after-free in Lua scripti...

Rocky Linux 9 [CIQ] Security Update: zziplib / zziplib-debuginfo / zziplib-debugsource / zziplib-devel / etc (crlsa-2024_2377)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242377 advisory. zziplib: invalid memory access at zzipdiskentrytofileheader in mmapped.c CVE-2020-18770 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: zziplib / zziplib-debuginfo / zziplib-debugsource / zziplib-devel / etc (crlsa-2024_3127)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243127 advisory. zziplib: invalid memory access at zzipdiskentrytofileheader in mmapped.c CVE-2020-18770 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_13602)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202513602 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux...

CVE-2026-95390

A flaw was found in Wireshark. By convincing a user to open a specially crafted PEAK CAN TRC trace file, an attacker can trigger an invalid memory access in the file parser. This issue causes the application to crash, resulting in a Denial of Service DoS. Mitigation Mitigation for this issue is...

CVE-2026-97508

A flaw was found in the Linux kernel's Thunderbolt subsystem. When a Thunderbolt domain is stopped, the driver fails to properly clear the root switch reference while handling active cross-domain requests. A connected host sending communication requests during domain shutdown can trigger an inval...

CVE-2026-88815

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv. When casting to SQLNUMERIC, sqltypecastsvpv passes the string pointer and length of the SV to groknumber without stringifying it first. An integer IV or floating-point NV value has no valid string...

OESA-2026-4045 sentencepiece security update

Security Fixes: Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.CVE-2026-1260...