The vulnerability of the `ftrace_func_mapper_add_ip()` function in the kernel/trace/ftrace.c module, which supports kernel tracing in Linux operating systems, allows a hacker to cause a service failure.

The vulnerability of the ftracefuncmapperaddip function in the kernel/trace/ftrace.c module, which supports kernel tracing in Linux operating systems, is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to trigger a...

PT-2026-28635

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.1.10 Drupal AI versions 1.2.0 through 1.2.11 Description An incorrect authorization issue exists in Drupal AI Artificial Intelligence that allows for resource injection. The module and certain submodules AI...

Resource Injection

Overview Affected versions of this package are vulnerable to Resource Injection via the buildProxyPass function. An attacker can execute arbitrary code and access sensitive information by injecting malicious configuration into the nginx controller process. Remediation Upgrade...

Resource Injection

Overview Affected versions of this package are vulnerable to Resource Injection via the buildProxyPass function. An attacker can execute arbitrary code and access sensitive information by injecting malicious configuration into the nginx controller process. Remediation Upgrade...

CVE-2026-3693 Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection

A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function getuserinfo/updateuserinfo of the file /src/backend/agentchat/api/v1/user.py of the component User Endpoint. This manipulation of the argument userid causes improper control of resource identifiers. It i...

CVE-2026-3693

Shy2593666979 AgentChat (up to 2.3.0) contains a vulnerability in the User Endpoint: get_user_info/update_user_info in /src/backend/agentchat/api/v1/user.py, where manipulating the argument user_id causes improper control of resource identifiers. The issue can be exploited remotely and an exploit...

The vulnerability of the btrfs_quota_enable() function in the fs/btrfs/qgroup.c module of the file system support module for Linux kernel allows a malicious actor to trigger a service failure.

The vulnerability of the btrfsquotaenable function in the fs/btrfs/qgroup.c module of the file system support for the Linux operating system is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to cause a service failur...

The vulnerability of the raid1_read_request() function in the drivers/md/raid1.c module of the Linux kernel support for multiple devices (RAID and LVM) allows a hacker to cause a service failure.

The vulnerability of the raid1readrequest function in the drivers/md/raid1.c module of the Linux kernel’s device drivers for RAID and LVM systems is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to cause service...

SUSE CVE-2026-27112

Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in...

CVE-2026-27112

Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in...

CVE-2026-27112 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in...

CVE-2026-27112 Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

Kargo manages and automates the promotion of software artifacts. From 1.7.0 to before v1.7.8, v1.8.11, and v1.9.3, the batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. Specially crafted payloads can manifest a bug present in...

GHSA-7G9X-CP9G-92MR Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

Summary The batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. When either endpoint creates a Project resource, creation of subsequent resources from that same payload belonging in that Project's underlying Kubernetes namespac...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the batch resource creation API endpoints when processing multi-document YAML payloads. An attacker can inject arbitrary resources into the underlying namespace of an existing project by sending specially...

PT-2026-20871

Summary The batch resource creation endpoints of both Kargo's legacy gRPC API and newer REST API accept multi-document YAML payloads. When either endpoint creates a Project resource, creation of subsequent resources from that same payload belonging in that Project's underlying Kubernetes namespac...

The vulnerability of the ena_com_cdesc_rx_pkt_get() function in the drivers/net/ethernet/amazon/ena/ena_eth_com.c file of the Ethernet network adapter support driver for Linux kernel allows a attacker to cause a system failure.

The vulnerability of the enacomcdescrxpktget function in the drivers/net/ethernet/amazon/ena/enaethcom.c file of the Ethernet adapter support driver for Linux operating systems is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow a...

The vulnerability of the hci_conn_del() function in the net/bluetooth/hci_conn.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to cause a service failure.

The vulnerability of the hciconndel function in the net/bluetooth/hciconn.c module of the Bluetooth subsystem in the Linux operating system is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow a attacker to cause service failures...

The vulnerability of the nvmf_reg_read32() function in the drivers/nvme/host/fabrics.c module of the Linux operating system’s NVME support driver allows a hacker to cause a service failure.

The vulnerability of the nvmfregread32 function in the drivers/nvme/host/fabrics.c module of the Linux kernel’s NVME support driver is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `nilfs_prepare_segment_for_recovery()` function in the `fs/nilfs2/recovery.c` module of the NILFS2 file system support module for Linux operating systems allows a hacker to cause a service failure.

The vulnerability of the nilfspreparesegmentforrecovery function in the fs/nilfs2/recovery.c module of the NILFS2 file system support in the Linux operating system is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the `flush_cache_all_local()` function in the `arch/parisc/include/asm/cacheflush.h` module, which is part of the PA-RISC architecture support for the Linux operating system, allows a attacker to compromise the integrity of protected information or cause service failures.

The vulnerability of the flushcachealllocal function in the arch/parisc/include/asm/cacheflush.h header file, which is part of the PA-RISC architecture support for the Linux operating system, is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerabilit...