Linux Distros Unpatched Vulnerability : CVE-2026-74702

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array...

Linux Distros Unpatched Vulnerability : CVE-2026-74732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Check for tg ops in dce110setavmute Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionall...

PT-2026-79615

In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext sk msg ring unpushed When the copy path in tls sw sendmsg locked adds the fragment that fills the plaintext sk msg ring, it does not set full record, so the record is left full and unpushed. A...

PT-2026-79689

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tap get user xdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in dev parse header protocol when skb-dev is null" fixed a crash in tap get user by assigning...

PT-2026-79711

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr dev fails during auxiliary device setup, the error path calls auxiliary device uninit, which eventually invokes bnge aux dev release. The release...

PT-2026-79731

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary is promisc under RTNL in bond alb monitor bond alb monitor reads primary is promisc under RCU, then drops RCU and takes RTNL via rtnl trylock before undoing the promiscuity it set on the active slav...

Linux Distros Unpatched Vulnerability : CVE-2026-74684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 net: tap: NULL pointer derefence in devparseheaderprotocol when...

Linux Distros Unpatched Vulnerability : CVE-2026-76905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go...

Linux Distros Unpatched Vulnerability : CVE-2026-74726

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via...

Linux Distros Unpatched Vulnerability : CVE-2026-74728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput pat...

Linux Distros Unpatched Vulnerability : CVE-2026-74610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does no...

DEBIAN-CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in convertParseError in openapi3filter/validationerrorencoder.go. An attacker can crash a server by sending a malformed multipart/form-data request body that triggers validation and is rendered through...

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

Summary A nil-pointer dereference in openapi3filter.ConvertErrors lets any unauthenticated client crash a server with a single HTTP request. When an application validates a multipart/form-data request body and renders the resulting validation error through the library-provided...

EUVD-2026-64150

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-56288

A flaw was found in GNU patch. An attacker can exploit this by providing a specially crafted patch file, which leads to a NULL pointer dereference. This improper handling of end-of-file markers can corrupt internal data structures, causing the utility to crash. This results in a denial of service...

CVE-2026-50812

A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users...

CVE-2026-17251

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...