CVE-2026-68178 misc: nsm: pin the module while the device is open

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

CVE-2026-68178 misc: nsm: pin the module while the device is open

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

EUVD-2026-55279

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

CVE-2026-68178 misc: nsm: pin the module while the device is open

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

PT-2026-69578

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NSM misc device where nsm dev fops.owner is left unset. When misc open is called, it uses fops get to pin the file operations::owner, but because the owner is unse...

PT-2026-69586

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the binfmt misc module where the load misc binary function incorrectly sets the have execfd flag before the interpreter is actually opened. If the interpreter open...

Linux fs/binfmt_misc Heap Buffer Overflow DoS

The vulnerability of the bmregisterwrite function in the fs/binfmtmisc.c file of the Linux kernel file system allows for the exploitation of resources after their valid duration has ended. Exploiting this vulnerability can enable a hacker to cause service failures...

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...

GHSA-MG4F-X9V4-6H2P Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...

Malicious Package

Overview 233-misc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-64609

Apache Fory (formerly Apache Fury) is vulnerable to an out-of-bounds read via sun.misc.Unsafe in the readAlignedVarUint() function. This occurs when the out-of-band zero-copy deserialization feature is enabled, potentially allowing an attacker to access sensitive information or cause an applicati...

CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

PT-2026-63279

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token...

EUVD-2026-35163

In the Linux kernel, the following vulnerability has been resolved: net: libwx: use requestirq for VF misc interrupt Currently, requestthreadedirq is used with a primary handler but a NULL threaded handler, while also setting the IRQFONESHOT flag. This specific combination triggers a WARNING sinc...

PT-2026-47369

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified openSUSE Tumbleweed versions prior to kernel-devel-7.0.12-1.1 Description An issue exists in the libwx network component where request threaded irq is used with a primary handler but a NULL threaded...

EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-2132)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nvme: nvme-fc: Ensure -ioerrwork is cancelled in nvmefcdeletectrlCVE-2025-40261 cifs: fix session state check in reconnect to avoid...

EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-2171)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nvme: nvme-fc: Ensure -ioerrwork is cancelled in nvmefcdeletectrlCVE-2025-40261 cifs: fix session state check in reconnect to avoid...

CVE-2026-40314: Missing Authorization

NamelessMC is website software for Minecraft servers. In version 2.2.4,core/classes/Misc/ProfilePostReactionContext.php only verifies that the wall post exists and does not enforce blocked/private-profile visibility. modules/Core/queries/reactions.php allows unauthenticated GET requests for...

UBUNTU-CVE-2026-48831

Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: Added .owner to vmclockmiscdevfops. Without the .owner field, the module can be unloaded while /dev/vmclock0 is open, resulting in an oops...