CVE-2026-15390 Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...

CVE-2026-15390 Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...

Ubuntu 18.04 LTS / 24.04 LTS : dracut vulnerabilities (USN-8828-1)

The remote Ubuntu 18.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8828-1 advisory. It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could...

CVE-2026-74222: Use After Free

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...

CVE-2026-15390: Out-of-bounds Write

Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...

This Week in Spring - September 29th, 2026

Hi, Spring fans! Welcome to another rip-roarin' and exciting installment of This Week in Spring! We've got a ton of cool stuff to look at this week, so let's dive right into it! an important update on Spring's release practice Speaking of which, we had a slew of releases on the 24th, including...

CVE-2026-71973: Integer Overflow or Wraparound

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

CVE-2026-101132

A path traversal vulnerability exists in DeepSeek deepseek-harness (versions up to 0.1.7-rc.2 ). The flaw is located within the loadProfile function of the packages/boot/app-boot/src/profile.ts file in the Bundle Patch Handler component. Manipulation of the dsh.bundle.patch argument allows for pa...

EUVD-2026-88438

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

CVE-2026-80359

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80357

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80358

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-98135

A flaw was found in the Linux kernel's NTFS file system driver. A local user capable of mounting storage volumes could cause a Denial of Service DoS and crash the operating system by mounting a specially crafted NTFS file system image. Due to missing input validation of the cluster configuration ...

K000163434: Spring Boot vulnerability CVE-2026-40976

Security Advisory Description In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on t...

CVE-2026-80359

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80359

Dell Boot Optimized Server Storage (BOSS) , versions prior to 2.2.13.2038 , is vulnerable to an On-Chip Debug and Test Interface With Improper Access Control in the SMCU on 17G BOSS-N1 controllers . An unauthenticated attacker with physical access could potentially exploit this flaw to gain Unaut...

CVE-2026-80359

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80358

Dell Boot Optimized Server Storage (BOSS) , versions prior to 2.2.13.2038 , is vulnerable to an On-Chip Debug and Test Interface With Improper Access Control flaw within the SMCU on 17G BOSS-N1 controllers . An unauthenticated attacker with physical access could potentially exploit this vulnerabi...

EUVD-2026-88297

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...

CVE-2026-80358

Dell Boot Optimized Server Storage BOSS, versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability,...