Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i2c: smbus – fixed the issue of NULL function pointers being dereferenced. Baruch reported an OOPS error when using the Designware controller as the target. Only targeting mode breaks the assumption that one transfer function ...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: i2c: validation of user data in compact ioctl commands. Incorrect user data may cause warnings in i2ctransfer. For example, it may result in no messages being sent at all. Userspace should not be able to trigger such warnings...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: removed the I2CHIDREADPENDING flag to prevent lock-ups. The I2CHIDREADPENDING flag is used to serialize I2C operations. However, this is not necessary, as the I2C core already has its own locking mechanism for this...

Linux Distros Unpatched Vulnerability : CVE-2026-89664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via...

CVE-2026-89664 nfsd: release OPEN-decoded posix ACLs via op_release

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

PT-2026-90380

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the nfsd component when processing OPEN compounds. The function nfsd4 decode createhow4 utilizes nfsd4 decode fattr4, which allocates refcounted struct posix acl...

GO-2026-6365 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) in github.com/siyuan-note/siyuan/kernel

SiYuan: path traversal via /export/temp/ short-circuit branch incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f in github.com/siyuan-note/siyuan/kernel...

Security Bulletin: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-69192 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATW...

GHSA-GW25-M53R-QH88 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

Summary SiYuan's /export/ file handler was hardened against export disclosure issue 12213 by adding an IsSubPathexportBaseDir, fullPath check and an IsSensitivePath check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit...

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

Summary SiYuan's /export/ file handler was hardened against export disclosure issue 12213 by adding an IsSubPathexportBaseDir, fullPath check and an IsSensitivePath check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit...

Missing Release of Resource after Effective Lifetime

Overview @libp2p/circuit-relay-v2 is an Implementation of Circuit Relay v2 Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the reserve path in packages/transport-circuit-relay-v2/src/server/reservation-store.ts. An attacker can grow...

8004skill (>=1.1.0, <=2.0.0), @a3stack/identity (0.2.0) +225 more potentially affected by CVE-2026-77384 via @libp2p/circuit-relay-v2 (>=2.1.5, <=4.2.7)

@libp2p/circuit-relay-v2 NPM version =2.1.5, =1.1.0, =1.0.4, =1.0.0, =1.0.0, =1.0.1, =0.1.0-alpha.1, =1.0.0, =0.0.1, =0.0.1, =0.0.4, =0.0.1, =0.0.12 - @blockless/browser-node 0.1.1 - @bluzelle/sdk 1.0.25 and more Source cves: CVE-2026-77384 Source advisory: SNYK:JS-LIBP2PCIRCUITRELAYV2-19256805...

CVE-2026-77384

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

EUVD-2026-65154

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384

@libp2p/circuit-relay-v2 (part of the js-libp2p JavaScript networking stack) is vulnerable to a remote denial of service in its reservation refresh path within reservation-store.ts. Prior to version 4.2.9 , each refresh reuses the same retimeableSignal but unconditionally registers an additional ...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limits the number of bytes that can be read via i2c to I2CSMBUSBLOCKMAX. The commit effa453168a7 “i2c: i801: Do not silently correct invalid transfer size” revealed that ee1004eepromread does not properly limit th...

CVE-2026-77384: Uncontrolled Resource Consumption

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...