Linux Kernel Security Vulnerabilities

The Linux kernel version 5.18 contains a security vulnerability. This vulnerability arises from the incorrect invocation of the bonding-specific API when processing team device events by using net/mlx5. This leads to out-of-bound memory access to the slab structure...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.14 has a security vulnerability. This vulnerability stems from improper filtering of connection flags or their combinations in the IPVS SYNC protocol in the file net/netfilter/ipvs/ipvssync.c. The combination of NOCPORT and TEMPLATE may cause normal connection searche...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains a security vulnerability. This vulnerability stems from emmactxmemmap in drivers/net/ethernet/spacemit/k1emac.c, which fails to clear the written TX descriptors when fragment mapping fails. As a result, the DMA engine may access an old address that has been...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.10 contains a security vulnerability. This vulnerability stems from the meshpathadd function in net/mac80211/meshpathtbl.c, which does not release the reserved mesh path quotas when path allocation or insertion fails. This can lead to repeated failures or repeated...

CLSA-2026-1792242216 ruby: Fix of CVE-2026-42246

CVE-2026-42246: fix Net::IMAPstarttls returning success without TLS on a man-in-the-middle error response - CVE-2026-42258: fix IMAP command injection via Symbol arguments...

MGASA-2026-0511 Updated perl-Net-Whois-Raw package fixes a security vulnerability

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. CVE-2026-19954...

CVE-2026-85363

A flaw was found in .NET. An integer overflow issue allows an unauthenticated remote attacker to achieve privilege escalation over the network. By convincing a user to process specially crafted input, an attacker can cause a calculation error that leads to unauthorized access with elevated...

CVE-2026-83520

A flaw was found in .NET. An insecure deserialization vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution over a network. By convincing an application or user to process specially crafted serialized data, an attacker can execute malicious commands with the...

CVE-2026-70197

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthenticated remote attacker to execute arbitrary code over the network. By sending specially crafted input to an affected application, an attacker can corrupt system memory and compromise the host environment...

CVE-2026-70035

A flaw was found in .NET. The vulnerability stems from insecure deserialization, where data transmitted over a network is reconstructed without adequate validation. A remote, unauthenticated attacker could exploit this issue by convincing a user to process specially crafted input. Successful...

CVE-2026-70190

A flaw was found in .NET. An authorized local attacker can exploit improper file link resolution before file access to achieve privilege escalation. By convincing a user to interact with a crafted file or link, the attacker can manipulate file paths to gain elevated privileges on the system...

CVE-2026-70161

A flaw was found in .NET. An authorized local attacker can achieve privilege escalation due to a path traversal vulnerability caused by improper file path restrictions. By manipulating file paths to access locations outside the intended directory, the attacker can gain elevated privileges on the...

CVE-2026-49868

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...

RLSA-2026:83207 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: nfnetlinkqueue: do shared-unconfirmed check before segmentation CVE-2026-45859 kernel: net/sched: actct: Only release RCU read lock after ctft CVE-2026-46319 kernel: net/sched:...

RLSA-2026:83156 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: actct: Only release RCU read lock after ctft CVE-2026-46319 kernel: net/sched: taprio: fix use-after-free in advancesched on schedule switch CVE-2026-53011 kernel: wifi:...

BIT-GOLANG-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

BIT-GOLANG-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

BIT-GOLANG-2026-94439 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...