CVE-2026-64146

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System component. During the initialization of inode extended attributes xattrs, certain error conditions can lead to a leak of metadata buffers. This memory leak can result in a denial of service DoS due to resource exhaustion...

postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind

A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pgbasebackup plain format and pgrewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical...

Important: Red Hat Security Advisory: postgresql:13 security update

An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2026-64066

A flaw was found in the Linux kernel's netfs component. The netfsreadtopagecache function does not properly pause the generation of new subrequests when a previously issued subrequest has failed. This oversight can lead to continued resource consumption or incorrect system state, potentially...

CVE-2026-64040

A flaw was found in the Linux kernel's cachefiles subsystem. When the vfsmkdir function fails, the system does not correctly extract the error code from the returned error pointer. This improper handling can lead to a null pointer being returned instead of a valid error, potentially causing a...

CVE-2026-64103

A flaw was found in the Linux kernel's ISCI IntelR C600 Series Chipset Storage Control Unit SCSI driver. This vulnerability occurs during device removal, where a timing issue can allow the system to attempt to use memory that has already been released. This 'use-after-free' condition could be...

CVE-2026-64036

A flaw was found in the Linux kernel. A local attacker with specific system privileges could exploit a vulnerability in the cgroup/rstat component. By manipulating a function that processes CPU Central Processing Unit statistics, an attacker could cause an out-of-bounds write. This could lead to ...

CVE-2026-64185

A flaw was found in the Linux kernel's sysfs component. When an attempt to update a sysfs group fails, the system can incorrectly remove an already existing sysfs directory. This unintended removal can lead to a denial of service or system instability by silently destroying critical system...

CVE-2026-14184 Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR

The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as complet...

CVE-2026-64187

A flaw was found in the Linux kernel's XFS filesystem log recovery component. A local attacker could exploit this vulnerability by crafting a malicious XFS log. When the system attempts to recover from this log, it triggers a null-pointer dereference, which can lead to a system crash. This result...

CVE-2026-63839

A flaw was found in the Linux kernel's Lenovo WMI Windows Management Instrumentation helpers. The lwmidevevaluateint function was identified to have a memory leak, where allocated memory was not properly released under certain conditions. This could lead to a gradual consumption of system memory,...

CVE-2026-63819

A flaw was found in the Linux kernel's f2fs Flash-Friendly File System component. A local attacker could create a specially crafted or corrupted f2fs filesystem that, when mounted and operated upon, would trigger a sanity check failure during filesystem truncation. This issue leads to a kernel...

CVE-2026-63818

A flaw was found in the Linux kernel's F2FS Flash-Friendly File System component. This vulnerability arises from improper validation of the orphan inode entry count during the recovery process. A local attacker could craft a malicious F2FS image, which, when mounted on an unpatched system, could...

CVE-2026-63817

A flaw was found in the Linux kernel's F2FS file system. When the compresscache mount option is disabled, a corrupted directory entry could point to an invalid inode number. The system incorrectly processes this as a valid internal inode, bypassing critical validation checks. This vulnerability...

CVE-2026-63816

A flaw was found in the f2fs Flash-Friendly File System component of the Linux kernel. This use-after-free UAF vulnerability occurs during garbage collection operations when handling Copy-On-Write COW files. A local attacker could exploit this by triggering garbage collection, leading to a...

CVE-2026-63814

A flaw was found in the Linux kernel's Flash-Friendly File System f2fs. A local attacker could exploit improper validation of Access Control List ACL entry sizes to cause a memory corruption, leading to a system crash or denial of service. This occurs when malformed ACL entries cause the system t...

CVE-2026-63812

A flaw was found in the Linux kernel's f2fs Flash-Friendly File System. Incorrect handling of extent information during inode destruction can lead to a stale extent cache. This can result in data integrity issues or filesystem corruption, potentially requiring administrative intervention to repai...

CVE-2026-63813

A flaw was found in the Linux kernel's f2fs Flash-Friendly File System component. A race condition can occur when an f2fs partition is nearly full, involving interactions between garbage collection, folio splitting, and LRU Least Recently Used isolation. This race can cause a folio a group of pag...

CVE-2026-63793

A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability, a use-after-free, arises from insufficient protection during concurrent operations on the volume label. A local attacker could exploit this by simultaneously setting and getting the file system label, which may le...

CVE-2026-64171

A flaw was found in the Linux kernel's i2c Tegra module. This vulnerability occurs when a mutex lock fails, leading to a power management PM runtime reference leak. This leak prevents the affected device from entering runtime suspend, which can lead to increased power consumption or other resourc...