CVE-2026-93801

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

PT-2026-104922

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifs open info data Stack-allocated cifs open info data may contain random data. This can make some fields have wrong value if they are not set later...

CVE-2026-93794: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

ROS-20260924-73-0053

The vulnerability of the isertwaitconn function in the drivers/infiniband/ulp/isert/ibisert.c module of the RTRS server and client kernel driver for the Linux operating system is related to state management errors. Exploiting this vulnerability could allow a remote attacker to compromise the...

Linux Distros Unpatched Vulnerability : CVE-2026-66072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw...

PT-2026-105014

An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client...

PT-2026-104886

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfs io -f -c "pwrite -b 3m -S 0x61 0 3m" -c "fpunch 1m 1m" -c "seek -h 0" -...

CVE-2026-93801: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

PT-2026-97978

Name of the Vulnerable Software and Affected Versions libXi versions prior to 1.8.4 Description An out-of-bounds read occurs in the XI2 class parser of libXi. This flaw allows a malicious X server to cause a crash of an attached X client. An out-of-bounds read is a condition where a program reads...

PT-2026-105010

An out-of-bounds read in libXi's XListInputDevices in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

PT-2026-98001

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the smb/client component where the stack-allocated cifs open info data is not zero-initialized. This can result in the structure containing random data, potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-93801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong valu...

CVE-2026-93543: Out-of-bounds Read

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client...

CVE-2026-48540: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

PT-2026-98262

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in other users' browsers via stored client-side template injection. This occurs when Vue.js template expressions, using double-brace syntax...

PT-2026-98290

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-93354: Initialization of a Resource with an Insecure Default

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

CVE-2026-48541: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

PT-2026-98199

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.90.3 Description The '/config/runtime' endpoint is registered without authentication. The system serializes the server configuration using a hide sensitive fields keyword filter that fails to recognize field nam...

CVE-2026-63645: Exposure of Sensitive Information to an Unauthorized Actor

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hidesensitivefields keyword filter. The filter does not recognize dsn or creds field...