Linux Distros Unpatched Vulnerability : CVE-2026-72425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: fix FDIR CTRL VSI resource leak in iceresetallvfs Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated...

Linux Distros Unpatched Vulnerability : CVE-2026-74301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Ad...

PT-2026-78236

Name of the Vulnerable Software and Affected Versions Streambert versions 2.5.0 through 2.5.9 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The wyzie-open-redeem IPC handler in index.js creates a partition:wyzie-redeem Electron...

CVE-2026-72116

A flaw was found in the Linux kernel's Broadcom Controller Area Network CAN bus driver. When a CAN device is removed, the driver may fail to properly manage its receive and transmit operations. This can lead to receive filters not being correctly re-enabled after updates, preventing expected data...

CVE-2026-72109

A flaw was found in the Linux kernel's sparx5 network driver. An improper cleanup during initialization failure can leave a switchdev blocking notifier registered. This issue could lead to resource exhaustion or system instability, potentially resulting in a Denial of Service DoS condition...

CVE-2026-72086

A flaw was found in the Linux kernel's scsi: xen: scsiback component. A pvSCSI guest can trigger a resource leak by issuing specific SCSI Small Computer System Interface requests when a task management operation fails. This vulnerability allows the guest to leak command tags associated with a...

CVE-2026-72082

A flaw was found in the Linux kernel's SCSI Small Computer System Interface elx: efct module. This vulnerability occurs when an I/O abort operation fails to properly release a resource reference. This can lead to a permanent resource leak, which prevents subsequent attempts to abort the same I/O...

CVE-2026-72081

A flaw was found in the Linux kernel's scsi: elx: efct driver. When processing an unsolicited Fibre Channel Protocol FCP command that contains an unsupported additional Command Descriptor Block CDB, the system fails to properly free allocated I/O resources. This resource leak can lead to resource...

CVE-2026-72077

A flaw was found in the Linux kernel's ims-pcu input driver. This vulnerability occurs when the firmware object is not properly released if validation fails during an asynchronous update. This oversight can lead to a firmware leak, potentially exposing sensitive information or system resources. T...

CVE-2026-71486

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...

CVE-2026-71486 vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...

CVE-2026-71486

In vLLM versions prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints process caller-supplied GenerateResponse objects via OnlineDerenderer and tokenizer.decode before enforcing max_model_len, max_tokens, max_num_seqs, or response-size limits. An authenticated...

CVE-2026-71486

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...

EUVD-2026-60362

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-66792

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-66792 Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into a...

CVE-2026-72041

A flaw was found in the Linux kernel's espintcp component. This vulnerability arises from incorrect message accounting when handling partial send operations. This could lead to inconsistencies in how network messages are managed, potentially causing unexpected behavior or resource management issu...

CVE-2026-72038

A flaw was found in the liquidio network driver within the Linux kernel. This vulnerability occurs when the cn23xxgetpfnum function fails, leading to Base Address Register BAR resources not being properly unmapped. This resource leak could potentially be exploited by a local attacker to cause a...

Allocation of Resources Without Limits or Throttling

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Buffer.concat and Buffer.from functions. An attacker can exhaust host memory resourc...

CVE-2026-72017

A flaw was found in the Linux kernel's MACB network driver. This driver fails to properly release outgoing Socket Kernel Buffers SKBs when the driver is closed. This continuous leakage of resources can lead to resource exhaustion over time, potentially resulting in a Denial of Service DoS conditi...