CVE-2026-93801

The Linux kernel contains a vulnerability in the smb/client component where the stack-allocated cifs_open_info_data is not zero-initialized. This allows the structure to contain random data , potentially causing fields to have incorrect values if they are not explicitly set later. No specific exp...

CVE-2026-93801 smb/client: zero-initialize stack-allocated cifs_open_info_data

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

CVE-2026-93794 smb/client: flush dirty data before punching a hole

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

EUVD-2026-86181

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

CVE-2026-93794 smb/client: flush dirty data before punching a hole

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

CVE-2026-93794

The Linux kernel contains a vulnerability in the smb/client component where punching a hole after a large buffered write can result in the range being incorrectly reported as data. This occurs because a dirty folio spanning the punched range can be written back after the punch, refilling the hole...

CVE-2026-93787 smb: client: bound dirent name against end of SMB response in cifs_filldir

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

CVE-2026-93210

The Linux kernel contains a vulnerability in the SMB client component where the DFS cache is not properly hardened against invalid target hints. Specifically, the get_tgt_name() function returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, while dfs_cache_noreq_update_tgthint() incorrectly assum...

CVE-2026-93210 smb: client: harden DFS cache against invalid target hints

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

Malicious code in c2-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5e21fe48a0a1a03a1846e11cb06360950603c3bd8ccba5979c431c84779ba0 The package name is 'c2-client' and package.json declares a postinstall hook that executes 'node setup.js' automatically on npm install. The setup...

MAL-2026-17165 Malicious code in c2-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5e21fe48a0a1a03a1846e11cb06360950603c3bd8ccba5979c431c84779ba0 The package name is 'c2-client' and package.json declares a postinstall hook that executes 'node setup.js' automatically on npm install. The setup...

CVE-2026-67231

A flaw was found in RabbitMQ. The trust-store plugin incorrectly validates client certificates by only matching the issuer name and serial number, rather than using the full certificate for path validation. This allows a remote attacker, who knows the issuer name and serial number of a whiteliste...

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise BEC operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series aroun...

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by gueco in WordPress Plugin Client Invoicing by Sprout Invoices versions = 20.8.17...

kernel: smb: client: fix double-free in SMB2_flush() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

CLEANSTART-2026-QY50458 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the fluent-operator package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CVE-2026-66077

A flaw was found in RabbitMQ. This vulnerability, a stored Cross-Site Scripting XSS, exists in the management UI. An attacker who can obtain a trusted TLS client certificate can embed malicious JavaScript in the certificate's Subject Distinguished Name DN. When the TLS listener is configured for...

kernel: smb: client: fix double-free in SMB2_flush() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

CVE-2026-97155

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empt...

EUVD-2026-85790

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empt...