CVE-2026-31966

A flaw was found in htslib, a library for reading and writing bioinformatics file formats. Specifically, within the CRAM Compressed Reference-oriented Alignment Map decoding process, insufficient validation of feature data series could allow a remote attacker to craft malicious CRAM records. This...

CVE-2026-23262

A memory corruption vulnerability was found in the Linux kernel's Google Virtual Ethernet gve driver. The driver and NIC share a memory region for statistics reporting, with the NIC calculating its write offset based on the region size. When queue count is increased, the driver resizes the stats...

CVE-2026-23251

A NULL pointer dereference vulnerability was found in the Linux kernel's XFS filesystem. The xfarraydestroy and xfblobdestroy functions are called without checking if the pointer is valid. When these destructors are invoked on NULL pointers during cleanup paths, a kernel crash occurs. The fix add...

CVE-2026-27978

A CSRF check bypass flaw has been discovered in Next.js. The origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts such as sandboxed iframes could bypass origin verification instead of being validated as cross-origin...

CVE-2026-23270

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control actct path when it is incorrectly configured with non-ingress egress qdiscs queueing disciplines. This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial ...

CVE-2026-32634

A flaw was found in glances. In Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself a...

CVE-2026-23248

A use-after-free vulnerability was found in the Linux kernel's perf subsystem. A race condition exists in perfmmap between a failing mmap setup and concurrent mmap operations on dependent events. When maprange fails, the cleanup path runs while the mmapmutex is released, allowing another thread t...

CVE-2026-22320

A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Telnet/SSH access to trigger memory corruption by supplying unexpected or oversized filename input. Exploitation results in the corruption of the internal buffer, causing the CLI a...

Linux Distros Unpatched Vulnerability : CVE-2026-23243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/umad: Reject negative datalen in ibumadwrite ibumadwrite computes datalen from user-controlled count and the MAD header sizes. With a mismatched user MAD...

Linux Distros Unpatched Vulnerability : CVE-2026-0602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowe...

Linux Distros Unpatched Vulnerability : CVE-2026-23250

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: check return value of xchkscrubcreatesubord Fix this function to return NULL instead of a mangled ENOMEM, then fix the callers to actually check for a null...

CVE-2026-23241

In the Linux kernel, the following vulnerability has been resolved: audit: add missing syscalls to read class The "at" variant of getxattr and listxattr are missing from the audit read class. Calling getxattrat or listxattrat on a file to read its extended attributes will bypass audit rules such...

Linux Distros Unpatched Vulnerability : CVE-2026-23554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done unde...

Linux Distros Unpatched Vulnerability : CVE-2026-32829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak...

Linux Distros Unpatched Vulnerability : CVE-2026-4271

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use- After-Free, occurs in the HTTP/2 server implementation. A...

CVE-2026-4177

Multiple security issues have been discovered in the perl YAML::Syck module. A heap overflow occurs when class names exceed the initial 512-byte allocation, a base64 decoder could read past the buffer end on trailing newlines. strtok mutated n-typeid in place, corrupting shared node data, and a...

CVE-2026-2454

A denial of service flaw has been discovered in mattermost server. Affected versions fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages to calls plugin. Mitigation...

CVE-2026-26230

A permissions validation flaw has been discovered in mattermost server. Affected versions fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mitigation Mitigation for this issue is either not...

CVE-2026-32627

A flaw was found in cpp-httplib. When a client is configured with a proxy and setfollowlocationtrue, any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target...

CVE-2025-54920

Apache Spark contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data. This allows an attacker with access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary...