717802 matches found
CVE-2026-99016
The Linux kernel contains a vulnerability in the RISC-V architecture's futex implementation. When the tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM , PMLEN != 0 ), the access_ok() function checks an untagged address, but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() pas...
CVE-2026-99016 riscv: futex: untag the user pointer before the atomic access
In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...
CVE-2026-99016
In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...
EUVD-2026-108807
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...
CVE-2026-99013
The Linux kernel contains a vulnerability in the Bluetooth ISO stack where concurrent listen() calls on the same broadcast socket can lead to a slab-use-after-free condition. This occurs because iso_sock_listen() drops the socket lock before calling iso_listen_bis(), allowing two callers to simul...
CVE-2026-99013 Bluetooth: ISO: Reject concurrent BIS listener setup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...
CVE-2026-98943
The Linux kernel contains a vulnerability within the HID: steam component related to improper locking behavior . Specifically, the issue involves RCU accesses that are not properly guarded behind a lock. The vulnerability has been addressed through a cleanup of these locking mechanisms. No specif...
CVE-2026-98943 HID: steam: Clean up locking
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock...
CVE-2026-98943
...
CVE-2026-56836
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...
CVE-2026-56835
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A...
CVE-2026-98937
In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perfeventopen currently gates perfallowkernel only on !attr.excludekernel. However, users can still request kernel callchain collection with...
EUVD-2026-108897
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native path lets callers configure allowed filesystem paths and...
EUVD-2026-108877
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...
EUVD-2026-108876
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A...
CLSA-2026-1792750763 kernel: Fix of 91 CVEs
net: skbuff: propagate shared-frag marker in skbzerocopy - net: bridge: stop fast-leave after deleting a port group CVE-2026-74480 - net: ipv6: clear suppressed fib6 rule result CVE-2026-74581 - net/sched: fix pedit partial COW leading to page cache corruption CVE-2026-46331 - ipvs: do not...
Vulnerability in Google Brotli-decoder
Google has discovered a vulnerability in the Brotli decompression library. This library is used in Node.js. An unauthorized malicious actor can exploit this vulnerability to process specially crafted Brotli-compressed data remotely. Successful exploitation could lead to a denial-of-service attack...
CVE-2026-112825
Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3...
CVE-2026-112359
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86...