Linux Distros Unpatched Vulnerability : CVE-2026-80630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schfqcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever fqcodel drops packets during peek, it calls...

CVE-2026-72364

A flaw was found in the netfs component of the Linux kernel. This vulnerability arises from improper error handling in the writebackiter loop. When an error occurs during writeback operations, the system fails to correctly clean up iteration states and manage memory folios. This can lead to...

CVE-2026-19360

A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The vendor was contacted...

CVE-2026-19005 nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the...

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge relates to improper resource management throughout its lifecycle. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the Tint component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Tint component in Google Chrome and Microsoft Edge relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

CVE-2026-64522

A flaw was found in the Linux kernel's mlx5e network driver. When handling temporary Security Associations SAs for IPsec, the mlx5exfrmaddstate function incorrectly decrements a counter without a corresponding increment. This underflow in the eswitch mode block mechanism can lead to a denial of...

CVE-2026-12502 Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo

Improper Privilege Management CWE-269 in /usr/bin/ltsudo in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to reset the password of any LARM user including the larmapp service account via the set-passwd...

CVE-2026-63859

A flaw was found in the Linux kernel's airoha network driver. The airohaqdmacleanuptxqueue routine, responsible for cleaning up transmit queues, was missing critical steps. This omission could lead to improper resetting of Direct Memory Access DMA transmit descriptors and incorrect notification t...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...

CVE-2025-13475

Technical details about CVE-2025-13475 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-13475 Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure

In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants,...

ROS-20260701-73-0027

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash...

CVE-2026-34194 GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index count

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintained for a sparse memory allocation. The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled acro...

PT-2026-47315

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintained for a sparse memory allocation. The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled acro...

CVE-2026-10217 nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management

A flaw has been found in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function handleSave of the file internal/http/ttsconfig.go of the component RoleAdmin Gateway. This manipulation causes improper privilege management. Remote exploitation of the attack is possible. The...

Astra Linux – Vulnerability in Firefox and Thunderbird

Poor management of ownership led to a “use-after-free” vulnerability in ReadableByteStreams. This vulnerability affects Firefox 120, Firefox ESR 115.5.0, and Thunderbird 115.5...

Astra Linux – Vulnerability in sudo

A flaw was discovered in sudo’s handling of ipahostname. In this process, the ipahostname value from /etc/sssd/sssd.conf was not propagated to sudo. As a result, this leads to a privilege management vulnerability in applications, where client hosts retain privileges even after those privileges ha...