EUVD-2026-45419

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability...

CVE-2026-16208

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability...

CVE-2026-16208

CVE-2026-16208 affects django-tastypie up to 0.15.1. The vulnerability resides in the CacheThrottle/CacheDBThrottle in tastypie/throttle.py, causing a race condition. It is potentially exploitable remotely; attack complexity is described as high. Details on fixes or patches are not provided in th...

PT-2026-61133

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system where the is meta ino function unconditionally treats F2FS COMPRESS INO as a meta inode. This occurs even when the compress cache mount option is...

PT-2026-61127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs file system during atomic write operations. When updating an atomic-write file, the f2fs write begin function may incorrectly use a COW Copy-on-Write inode to...

PT-2026-61093

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fuse module. The fuse try move folio function unlocks the request upon entry but fails to re-lock it during the success path. Consequently, fuse chan...

PT-2026-61476

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs component where the zero point—the file position from which the system assumes the server will return zeros to avoid unnecessary reads—is updated incorrectly...

MiracleLinux 9 : flatpak-1.12.9-4.el9_8.1 (AXSA:2026-1286:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1286:03 advisory. flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options CVE-2026-34078 flatpak: Flatpak: Arbitrary file deletion o...

PT-2026-61374

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The afs filesystem in the kernel implements incorrect locking for symbolic links. This leads to several issues, including a lack of locking around the afs read single function, which can...

PT-2026-61450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds OOB array access occurs in the asihpi component of the ALSA Advanced Linux Sound Architecture subsystem. The find control function retrieves cached information by...

PT-2026-61348

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the erofs component when handling unaligned compressed extents. This occurs when one thread executes filemap add folio but has not yet called folio attach...

PT-2026-61323

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter nf tables component where destination corruption occurs during same register operations. For lshift and rshift operations, the system performs shifts in ...

PT-2026-61192

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture where the tlb flush function failed to properly invalidate the walk cache when unsharing PMD tables. Specifically, the function only checked...

PT-2026-61042

A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability...

PT-2026-61129

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition in the F2FS Flash-Friendly File System implementation can lead to list corruption and kernel panics, particularly when the F2FS partition is nearly full. The issue occur...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the getUpstream function. An attacker can gain unauthorized access to or modify data across differen...

CVE-2026-16158

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

CVE-2026-16158

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

EUVD-2026-45373

Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URL...

CVE-2026-16158

CVE-2026-16158 affects @fastify/reply-from. The vulnerability stems from how the internal URL cache key is built by concatenating the destination and source paths without a delimiter in versions 8.3.1 up to (but not including) 12.6.4. This can cause key collisions where different upstreams resolv...