CVE-2026-80959 dm-pcache: bound the persisted tail-position offset

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

CVE-2026-80959

CVE-2026-80959 affects the Linux kernel's dm-pcache (device-mapper persistent cache) component. The root cause is in cache_pos_decode() , which uses persisted key_tail and dirty_tail seg_off values to address data within a cache segment. A seg_off at or past the segment data_size , controllable b...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1 , the escapeLogField() function fails to escape the double quote character, which delimits quoted fields in the Apache combined log format. An unauthenticated remote attacker who controls a value written to a quote...

PT-2026-90206

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 file system where the directory cookie position is incorrectly rebuilt in the ocfs2 dir foreach blk el function on 32-bit kernels. This occurs because the ma...

PT-2026-90242

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where the RPC/RDMA Read chunk position field, provided by a remote client, is not properly validated against the received inline body length. The...

CVE-2026-86292

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. Th...

CVE-2026-86292 SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. Th...

PT-2026-84572

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit personal Endpoint. Such manipulation of the argument position id leads to dynamically-determined object...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: anx7625: Fixed an overflow issue when reading EDID. The length of the EDID block can be longer than 256 bytes. Therefore, we should use int instead of u8 for the edidpos variable...

EUVD-2026-60487

A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An attacker in a privileged network position may be able to cause a denial-of-service...

CVE-2026-43667

A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to cause a denial-of-service...

CVE-2026-74566

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

UBUNTU-CVE-2026-74566

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

EUVD-2026-59631

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

UBUNTU-CVE-2026-74306

In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix fpos race in qatvfresumewrite qatvfresumewrite checks filp-fpos before taking migf-lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent write...

Improper Validation Of User-Controlled Retry Header Value

Spring Kafka is vulnerable to improper validation of user-controlled retry header value. The vulnerability is due to insufficient validation of the retrytopic-attempts header, which allows an attacker to craft an out-of-range retry attempt count and cause the retry topic router to incorrectly...

EUVD-2026-56133

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-64565 Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

EUVD-2026-52606

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

CVE-2026-64565

CVE-2026-64565 (Linux kernel, ims-pcu driver) fixes a heap-buffer-overflow in ims_pcu_process_data(). The bug: input data processed byte-by-byte without checking read_pos against IMS_PCU_BUF_SIZE, allowing a larger-than-expected USB packet to increment read_pos and, via proximity to read_buf, ove...