CVE-2026-43361 btrfs: fix transaction abort when snapshotting received subvolumes

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort when snapshotting received subvolumes Currently a user can trigger a transaction abort by snapshotting a previously received snapshot a bunch of times until we reach a BTRFSUUIDKEYRECEIVEDSUBVOL item...

CVE-2026-43359

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the BTRFSUUIDKEYRECEIVEDSUBVOL we have to abort the transaction since we did...

CVE-2026-43299

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT when the fs flips RO inside btrfsrepairiofailure BUG There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO this part is expected, although the ENOSPC bug still needs to be...

CVE-2026-43299 btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not ASSERT when the fs flips RO inside btrfsrepairiofailure BUG There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO this part is expected, although the ENOSPC bug still needs to be...

PT-2026-39021

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs filesystem where creating multiple files with names that result in the same hash can lead to a transaction abort. This occurs because files with colliding...

PT-2026-39020

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the btrfs component where the 'set received' ioctl can trigger a transaction abort due to an item overflow when adding the BTRFS UUID KEY RECEIVED SUBVOL. A user who...

Linux Distros Unpatched Vulnerability : CVE-2026-43359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the...

Linux Distros Unpatched Vulnerability : CVE-2026-43361

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: fix transaction abort when snapshotting received subvolumes Currently a user can trigger a transaction abort by snapshotting a previously received...

Hugo's Node tool execution allows file system access outside the project directory

Impact When building a Hugo site that uses Node-based asset pipelines PostCSS, Babel, TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write...

HCL BigFix Service Management 安全漏洞

HCL BigFix Service Management is an IT service management and asset management platform developed by the Indian company HCL. HCL BigFix Service Management SM has security vulnerabilities. These vulnerabilities stem from the root file system being mounted in read-only mode. An improperly configure...

JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request

The allow-list of extensions that can be installed from PyPI Extension Manager allowedextensionsuris is not correctly enforced by JupyterLab prior to 4.5.7. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This has security implications for deployments...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-010850)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010850 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not write dirty data after degenerating to read-only According to syzbot's report,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013231)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013231 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfsroot in nilfsevictinode During unmount process of nilfs2,...

Authorization Bypass

mcp-neo4j-cypher is vulnerable to Authorization Bypass. The vulnerability is due to the readonly mode enforcement being bypassable using APOC CALL procedures, where unauthorized write operations or server-side request forgery can occur and attackers can exploit this to gain unauthorized access...

Insufficient Granularity of Access Control

Overview mcp-neo4j-cypher is an A simple Neo4j MCP server Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the readonly mode in CALL procedures. An attacker can perform unauthorized actions and potentially access internal resources by bypassing...

CVE-2021-31899

In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-993076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993076 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not write dirty data after degenerating to read-only According to syzbot's report,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992431 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not write dirty data after degenerating to read-only According to syzbot's report,...

CVE-2023-53804

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfsroot in nilfsevictinode During unmount process of nilfs2, nothing holds nilfsroot structure after nilfs2 detaches its writer in nilfsdetachlogwriter. However, since nilfsevictinode uses...

CVE-2025-58337

An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized...