CVE-2026-14441: Comparison Using Wrong Factors

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential...

PT-2026-98304

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic flaw in Java cache key handling object comparison could lead to improper identifier resolution when processing specific user account structures. This iss...

PT-2026-97926

Name of the Vulnerable Software and Affected Versions libconfini version 1.16.4 Description A heap out-of-bounds write condition exists involving the bundled load ini buffer.h utility and the strip ini cache function. The utility allocates exactly ini length bytes, but strip ini cache writes a NU...

CVE-2026-96744: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence...

CVE-2026-93208: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: kasan: fix cache shrink race with CPU hotplug kasanquarantineremovecache first invokes percpuremovecache on all online CPUs. Each callback moves objects belonging to the cache from cpuquarantine to the CPU's shrinkqlist, where th...

CVE-2026-93210: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

PT-2026-104969

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, get tgt name returns ERR PTR-ENOENT when ce-tgthint is NULL, and dfs cache noreq update tgthint assumes ce-tgthint is always valid. In preparation for clearing...

CVE-2026-93210

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

CVE-2026-92530: Use of Less Trusted Source

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

PT-2026-97875

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Linux kernel between cache shrinking and CPU hotplugging. The function kmem cache shrink does not hold cpus read lock, allowing it to race with CPU...

PT-2026-97877

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client DFS cache where the get tgt name function returns an error pointer when the ce-tgthint variable is NULL. Additionally, the dfs cache noreq update tgthin...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: unbound (UTSA-2026-123924)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-123924 advisory. In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS...

CVE-2026-92530 Use of Less Trusted Source in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

CVE-2026-92530

GitLab CE/EE versions 19.1 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are vulnerable to an issue where an authenticated user could spoof merge request authorship and attribute content to arbitrary existing users. This occurs due to an improper reliance on ephemeral cache state du...

CVE-2026-92530 Use of Less Trusted Source in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-41707

A flaw was found in Spring Security's DPoPProofJwtDecoderFactory. This vulnerability allows a remote attacker to perform a replay attack by flooding the server with dummy requests, which evicts legitimate entries from an internal cache storing JSON Web Token JWT ID claims. Consequently, an attack...

SUSE CVE-2026-89092

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

SUSE CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

SUSE CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...