19156 matches found
PT-2026-90206
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2 dir foreach blk el, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-s blocksize - 1 | offset; ctx-pos is loff t signed 64-bit, while sb-s...
PT-2026-90460
In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode for each child node When iterate over children of a fwnode that has a secondary fwnode, fwnode get next child node can enter an infinite loop if the secondary fwnode has more than one...
PT-2026-90363
In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat ceph trim dentries if no progress possible ceph cap reclaim work re-queues itself for as long as ceph trim dentries returns -EAGAIN, which happens whenever a lease walk exhausts its nr to scan budget. This...
PT-2026-90087
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: detect a cycle in the last-kset chain during replay cache replay follows the on-media last-kset chain by next cache seg id with no cond resched. A forged chain that points back into a segment it has already visited mak...
PT-2026-90294
In the Linux kernel, the following vulnerability has been resolved: dm-io: clone the source bio instead of copying its biovec For DM IO BIO requests, do region built each destination bio by walking the source bio's biovec and re-adding the pages one at a time, tracking the remaining transfer in...
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...
tar: Node-tar: Denial of Service via malformed tar archive header
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...
EUVD-2026-75170
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout...
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...
EUVD-2026-75172
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle...
Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...
CVE-2025-6018
CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide δΈζ π Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image...
CVE-2026-89045
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...
DEBIAN-CVE-2026-89045
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...
CVE-2026-88053
Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATAINTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validati...
CVE-2026-89045 zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...
CVE-2026-89045
zstd-jni versions 1.4.8-4 through 1.5.7-13 contain a denial-of-service vulnerability in ZstdInputStreamNoFinalizer.read(). The method fails to validate negative length parameters, causing an infinite loop while holding the stream monitor and blocking all other threads from accessing the stream. T...
EUVD-2026-75634
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...
CVE-2026-89045 zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length
zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...
CVE-2026-88053
Tesseract OCR engine (version 5.5.3 and earlier) is vulnerable to a heap out-of-bounds write in Classify::ReadIntTemplates (src/classify/intproto.cpp). The function reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses them...