CVE-2026-66374

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ DNS-over-QUIC receive path...

CVE-2026-66374

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ DNS-over-QUIC receive path...

PT-2026-64602

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the SMB client within the receive encrypted standard function. The function allocates a next buffer before verifying if the number of compound PDUs Protocol Data...

PT-2026-64758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where the hyperv receive sub function processes VMBus packets without verifying the actual number of bytes written by the host into hv-recv bu...

libp2p: yamux connection DoS via oversized data frame

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

GHSA-HMJ8-5XMH-5573 libp2p: yamux connection DoS via oversized data frame

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

SUSE CVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result

A flaw was found in the Linux kernel's Wi-Fi mac80211 subsystem. The ieee80211invokefastrx function uses a static variable for rxresult, which is shared across concurrent calls. This can lead to incorrect processing of Wi-Fi packets, where a packet might be mishandled or its status incorrectly...

GO-2026-6043 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea...

TencentOS Server 2: rsync (TSSA-2026:0727)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0727 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

EUVD-2026-41636

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...

GHSA-649P-MMHF-85C7 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...

CVE-2026-10678 NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...

CVE-2026-63867

A flaw was found in the Linux kernel's Multipath TCP MPTCP implementation. A race condition exists when computing the receive window, where the acknowledgment sequence number is accessed without proper locking. This can lead to inconsistencies in how the receive window is calculated and...

CVE-2026-59139 Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked. The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents...

SUSE CVE-2026-63959

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpcimaxim: validate header NDO against RXBYTECNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, an...

SUSE CVE-2026-64025

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership...

SUSE CVE-2026-64056

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

SUSE CVE-2026-64117

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...