UBUNTU-CVE-2026-82254

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82259

SvelteKit versions 2.49.0 through 2.53.2 (fixed in 2.53.3 ) are affected by a deserialization expansion vulnerability in the experimental form remote function . When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files....

CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

EUVD-2026-67706

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82254

gitoxide before 0.69.0 is vulnerable to denial of service via its gix-pack component. The root cause is unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers . An attacker can send crafted pack data during clone or fetch operations to trigger ...

CVE-2026-82254

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

CVE-2026-80723

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80627

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array, but checks whether the array is full only after it has filled the selected entry. If walksystemramrange...

UBUNTU-CVE-2026-80598

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read...

CVE-2026-80598

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read...

CVE-2026-80627

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array, but checks whether the array is full only after it has filled the selected entry. If walksystemramrange...

UBUNTU-CVE-2026-80609

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...

CVE-2026-80723 of: reserved_mem: prevent OOB when too many dynamic regions are defined

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

EUVD-2026-67458

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a local array of size MAXRESERVEDREGIONS. If the device tree defines...

CVE-2026-80672

CVE-2026-80672 is a u16 truncation in the Linux kernel's in-kernel NTFS driver, specifically in ntfs_check_restart_area(). The variable ra_len is declared as u16, but the computed length of the $LogFile log client record array can exceed 65535 (e.g., log_clients of 410 yields 65600), causing trun...

EUVD-2026-67503

In the Linux kernel, the following vulnerability has been resolved: MIPS: mm: Fix out-of-bounds write in maarreswalk maarreswalk uses wi-numcfg as the index into the fixed-size wi-cfg array, but checks whether the array is full only after it has filled the selected entry. If walksystemramrange...