32474 matches found
SUSE CVE-2026-63867
In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...
CVE-2026-64253
In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...
DEBIAN-CVE-2026-64223
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...
GHSA-RG4H-FPCP-2QM8 Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary Microsoft Kiota resolved OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary...
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary Microsoft Kiota resolved OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary...
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
Summary ray.data.readwebdatasetpaths=... is a @PublicAPIstability="alpha" reader for WebDataset-format TAR files. Its default decoder=True invokes defaultdecoder on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled...
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled...
EUVD-2026-48662
In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...
CVE-2026-64253 kernel/fork: clear PF_BLOCK_TS in copy_process()
In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...
CVE-2026-64253
In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PFBLOCKTS in copyprocess PFBLOCKTS is only set in blktimegetns when current-plug is non-NULL, and blkfinishplug clears it via blkflushplug before NULLing the plug pointer. copyprocess breaks the invariant by...
CVE-2026-64233 usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...
CVE-2026-64223
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...
EUVD-2026-48622
In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...
CVE-2026-64214
CVE-2026-64214 affects the Linux kernel on PowerPC where arch_irq_work_raise() redundantly called preempt_disable()/preempt_enable() while handling machine check exceptions in real mode. The MCE/NMI context is not preemptible, so the extra preemption protection could fault when accessing preempt_...
CVE-2026-55732
Out-of-bounds Read CWE-125 in BACnet packet parsing bacdtdatetimetotod in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash linxa64.exe and ultimately reboot the device via a malformed BACnet...
CVE-2026-55732
Out-of-bounds Read CWE-125 in BACnet packet parsing bacdtdatetimetotod in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash linxa64.exe and ultimately reboot the device via a malformed BACnet...
CVE-2026-55732 Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod)
Out-of-bounds Read CWE-125 in BACnet packet parsing bacdtdatetimetotod in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash linxa64.exe and ultimately reboot the device via a malformed BACnet...
EUVD-2026-48597
Out-of-bounds Read CWE-125 in BACnet packet parsing bacdtdatetimetotod in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash linxa64.exe and ultimately reboot the device via a malformed BACnet...
CVE-2026-55732
Loytec CVE-2026-55732: An out-of-bounds read in BACnet packet parsing (bacdt_datetime_to_tod) affects LINX-A64 firmware and multiple Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.18. The vulnerability allows an unauthenticated remote attacker to...