CVE-2026-62435

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

vulnerabilities found in Apple MacOS

Apple has addressed several vulnerabilities in MacOS, specifically in the versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.x. These vulnerabilities involve various security issues in macOS, including insufficient sandbox restrictions, which may allow applications to gain unauthorized access t...

CVE-2026-64057

A flaw was found in the Linux kernel's AFS Andrew File System component. This vulnerability involves incorrect locking when processing symbolic links, which can lead to race conditions and memory leaks. These issues could result in resource exhaustion and impact system stability...

CVE-2026-64098 drm/virtio: use uninterruptible resv lock for plane updates

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtiogpucursorplaneupdate and virtiogpuresourceflush lock the framebuffer BO's dmaresv via virtiogpuarraylockresv and ignore its return value. The function can fail wit...

SUSE-SU-2026:22711-1 Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

PYSEC-2026-2340 ajenti.plugin.core has race conditions in 2FA

Impact If the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible...

PYSEC-2026-1586 Lollms has an Improper Access Control vulnerability

A vulnerability in the lollmsgenerationevents.py component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The addevents function registers event handlers such as generatetext, cancelgeneration, generatemsg, and generatemsgfrom without implementing...

CVE-2026-53086

A flaw was found in the Linux kernel's bcmgenet network driver. This vulnerability arises from an overly aggressive timeout handler that attempts to reset all network transmission queues when only one experiences an issue. This behavior can create race conditions, potentially leading to system...

CVE-2026-53049

A flaw was found in the Linux kernel's Global File System 2 GFS2 component. The gfs2logd function, responsible for log flushing, calls several log flushing functions without holding the required lock. This omission allows concurrent transactions to access shared resources without proper exclusion...

CVE-2026-53086

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenettimeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along...

CVE-2026-53086

The CVE concerns the Linux kernel bcmgenet driver: the bcmgenet_timeout handler erroneously attempts to bring down all TX queues when a single queue times out, creating race conditions with active queues. The fixed behavior restarts only the timed-out queue, mitigating the race. Reported impact i...

Astra Linux – Vulnerability in Intel Microcode

Hardware logic in some Intel processors may contain race conditions, which could allow an authenticated user to potentially enable partial information disclosure through local access...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: pseries/papr-hvpipe: Fixed race conditions with interrupt handlers. When executing the -ioctl handler or the -release handler, if an interrupt occurs on the same CPU, a deadlock can occur. This patch fixes both handlers to use...

Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

...

SUSE CVE-2026-11611

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during...

ACPM Concurrent Transfer Stress Tester for Channel Synchronization Validation

This C program is a multi-threaded concurrency reproducer intended to stress-test concurrent invocations of acpmdoxfer against the same ACPM channel in order to observe synchronization behavior, race conditions, error handling, and driver stability under contention...

Microsoft Remote Desktop Client 竞争条件问题漏洞

Microsoft Remote Desktop Client is a remote desktop client developed by Microsoft Corporation. The Microsoft Remote Desktop Client has vulnerabilities related to race conditions. The following products and versions are affected: Windows 10 Version 1809 for 32-bit systems, Windows 10 Version 1809...

LIGHTNINGLINK X-VPN 安全漏洞

LIGHTNINGLINK X-VPN is a virtual private network service client provided by LIGHTNINGLINK Corporation. Versions 77.0 to 77.5 of LIGHTNINGLINK X-VPN contain security vulnerabilities. These vulnerabilities stem from race conditions and symbolic link operations within the isolation and recovery...

DEBIAN-CVE-2026-11611

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during...

UBUNTU-CVE-2026-11611

A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during...