CVE-2026-64777

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0...

Linux Distros Unpatched Vulnerability : CVE-2026-65976

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to...

Linux Distros Unpatched Vulnerability : CVE-2026-75625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying on...

UBUNTU-CVE-2026-75625

Kraken agents fail to verify peer-to-peer downloaded blobs against the...

CVE-2026-75625

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

EUVD-2026-61139

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

CVE-2026-65976 Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy16.cpp or client path in...

PT-2026-76823

Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a connected peer can send repeated DCLP DataChunk messages to ClipboardChunk::assemble in src/lib/deskflow/ClipboardChunk.cpp, causing the server path in src/lib/server/ClientProxy1 6.cpp or client path i...

CVE-2026-72014

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

UBUNTU-CVE-2026-72014

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

CVE-2026-72014

CVE-2026-72014 affects the Linux kernel DRBD path: recv_dless_read() can accept a P_DATA_REPLY with a negative data_size due to peer-controlled inputs and digest subtraction or unsigned length handling, leading to a negative, unbounded payload check and a subsequent memory access beyond a bio pag...

EUVD-2026-59113

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

CVE-2026-68342 ovpn: avoid putting unrelated P2P peer on socket release

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-47249

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataTypeHashArrayType direct request that is only 442 bytes on the wire but expan...

CVE-2026-47249 Klever-Go KVM: Hash-array amplification in P2P resolver request handling

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataTypeHashArrayType direct request that is only 442 bytes on the wire but expan...

CVE-2026-47249

CVE-2026-47249 affects Klever-Go KVM (Go implementation of Klever) prior to v1.7.18. The issue is in P2P resolver request handling where a compressed RequestDataType_HashArrayType direct request (wire size ~442 bytes) can expand into about 200,000 decoded hash entries inside the resolver path. Th...

MINI-VJCJ-935M-3P2P

Bulletin has no description...

SUSE CVE-2026-64020

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dmavecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dmavec allocation was getting leaked on the completion...

CVE-2026-64020

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dmavecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dmavec allocation was getting leaked on the completion...

CVE-2026-64020 nvme-pci: fix dma_vecs leak on p2p memory

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dmavecs leak on p2p memory We don't unmap P2P memory, so we don't need to track it. The dmavec allocation was getting leaked on the completion...