CVE-2026-74796: Improper Link Resolution Before File Access

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

Linux Distros Unpatched Vulnerability : CVE-2026-72888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smartrequire. smartrequire stores results in a...

SUSE CVE-2026-74463

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...

SUSE CVE-2026-74487

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...

SUSE CVE-2026-74551

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

Allocation of Resources Without Limits or Throttling

Overview org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the handling of the localized-text cache. An...

CVE-2026-74561

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

CVE-2026-74551

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

CVE-2026-74487

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...

CVE-2026-74482

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74561

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

CVE-2026-74551

CVE-2026-74551 affects the Linux kernel hwmon path for nzxt-smart2. The issue arises when send_output_report() triggers USB HID DMA mapping via hid_hw_output_report(), which maps the output buffer for DMA using usb_interrupt_msg(). On non-coherent CPUs (e.g., ARM/MIPS), flushing/invalidating the ...

EUVD-2026-59616

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

CVE-2026-74551 hwmon: (nzxt-smart2) DMA-align output buffer

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg which maps this buffer directly for DMA. When the DMA mapping flushes or...

CVE-2026-74487

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...

CVE-2026-74482 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: unlock immaprwsem before releasing after-split folios foliosplit keeps dereferencing the mapping after the split: shmemunchargemapping-host and remappage while the folios are still frozen/locked, and...

CVE-2026-74482

CVE-2026-74482 — Linux kernel (mm/huge_memory) . The issue arises during THP folio splitting in mm/huge_memory.c: __folio_split dereferences the mapping after the split while folios are still frozen/locked, and calls remap_page() and shmem_uncharge() before unlocking the after-split folios. This ...

CVE-2026-74463

In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF preparelock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework CCF and the I2C adapter lock, which triggers when an I2C-controlled clock generator...

CVE-2026-73635

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

EUVD-2026-59604

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...