CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

EUVD-2026-41133

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHEPSK ServerKeyExchange message...

CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

CVE-2026-54909 Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

EUVD-2026-51666

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

CVE-2026-52856 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

CVE-2026-52856

Wings (server control plane for Pterodactyl) contains a vulnerability in which a malformed packet during the SFTP handshake can trigger a Go panic. This affects versions prior to 1.13.0. The issue is resolved in 1.13.0. Impact is described as a denial of service (Go panic) with a HIGH CVSS v3.1 b...

CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic. Impact All wings users with an open SFTP port. Workarounds Close SFTP port...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

RLSA-2026:47040 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xfrm: Duplicate SPI Handling CVE-2025-39797 kernel: lib/buildid: use kernelread for sleepable context CVE-2026-23002 kernel: futex: Drop CLONETHREAD requirement for private default hash...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

SUSE CVE-2026-48708

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance tpl package-level variable in service/internal/tpl/templates.go across all goroutines. Every action execution calls...

CVE-2026-64429

A flaw was found in the Linux kernel. The Spreadtrum EIC External Interrupt Controller driver incorrectly uses a standard spinlock in a critical interrupt handling path. When running on a PREEMPTRT Preemptible Real-Time kernel, this can cause the system to attempt to sleep in an invalid context...

CVE-2026-64275

A flaw was found in the Linux kernel's Elan I2C touchpad driver. This vulnerability occurs when the driver receives invalid zero values for touchpad dimensions from device firmware or the device tree, or when a calculated width is too small. A local attacker with control over device input or a...

CVE-2026-64364

A flaw was found in the Linux kernel's Human Interface Device HID multitouch subsystem. A remote attacker can exploit this vulnerability by connecting a specially crafted multitouch device that advertises a large contact count. This can lead to an out-of-bounds bit access, corrupting adjacent...

CVE-2026-64324

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. The udffreeblocks function fails to properly validate free block extents against the partition length. This allows a local, unprivileged user to create a specially crafted UDF filesystem that, when a file on it is...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Failure Record: MT6985 Adaptation Attempt...

CVE-2026-64474

A flaw was found in the Linux kernel's Virtual Function I/O VFIO device migration feature. The vfiomiggetnextstate function, responsible for managing device migration states, contains an infinite loop. This occurs when processing certain blocked transitions, causing the system to hold a driver...