76995 matches found
EUVD-2026-75760
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system...
EUVD-2026-75773
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...
PT-2026-90081
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested max payload len svc i3c master handle ibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVC I3C FIFO SIZE, not by the...
PT-2026-90152
In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix sentinel write past pcc-sinf acpi pcc retrieve biosdata rejects SINF packages only when pcc-num sifr is strictly less than hkey-package.count, then unconditionally writes a trailing sentinel at...
PT-2026-90470
In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walk pmd range If -pmd entry sets walk-action = ACTION AGAIN, the pmd none check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk-ops-install pte is...
PT-2026-90144
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk store and kek store sk store and kek store strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if buflength - 1 == ' ' length--; bioscf...
PT-2026-90338
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp i2c smbus read stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. On...
PT-2026-90221
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method elm The legacy write path dispatches through a uverbs api write method, but the uverbs attr bundle passed to provider code does not have an ioctl method element. If malformed...
PT-2026-90413
In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh want write for early-verified SETATTR in nfsd proc setattr The BOTH TIME SET branch calls fh verify early so setattr prepare can inspect the dentry. This causes nfsd setattr to skip fh want write, so notify change ru...
PT-2026-90369
In the Linux kernel, the following vulnerability has been resolved: ceph: reject export targets ranks = CEPH MAX MDS in mdsmap decode MDSMap export targets entries are monitor controlled. check new map uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespa...
PT-2026-90513
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...
PT-2026-89804
Patch CVE-2026-16338 immediately. Learn how this 9.9 CVSS flaw allows arbitrary file write attacks in IBM DataStage and how to secure your data today. CVE202616338 IBMDataStage CyberSecurity InfoSec ArbitraryFileWrite CloudSecurity Vulnerability https://t.co/k9OgrO33Vv https://t.co/lVFSA4z6H7...
PT-2026-90147
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensor num. cros ec sensorhub ring handler validates the FIFO event count, the per-read count and the ring bound...
Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : PHP vulnerabilities (USN-8743-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8743-1 advisory. It was discovered that PHP incorrectly handled backslash escaping in the...
CVE-2026-90445: Improper Limitation of a Pathname to a Restricted Directory
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...
CVE-2026-89653: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...
CVE-2026-89656: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...
CVE-2026-89674: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...
CVE-2026-89559: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89495: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlmmigraterequesthandler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in ...