kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

CVE-2026-76787

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CLSA-2026-1791820487 Fix CVE(s): CVE-2026-19445, CVE-2026-4786

SECURITY UPDATE: use-after-free in the ssl module when a servername callback switches the connection to another SSLContext - debian/patches/CVE-2026-19445.patch: look the SSLContext up from the SSL object instead of the borrowed servername-callback argument and hold references to it and to the...

CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CVE-2026-76787

The UpdateHub firmware-over-the-air (FOTA) client in Zephyr is vulnerable to a NULL pointer dereference within the z_impl_updatehub_probe() function. The issue occurs because the JSON decoder treats the sha256sum field as optional; if a network peer omits this string in a CoAP probe response, the...

EUVD-2026-104599

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CLSA-2026-1792441390 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...

CVE-2026-48932

A flaw was found in the Node.js HTTP client. This vulnerability can cause a request desynchronization in Node.js-based forwarding proxies. A remote attacker could exploit this by sending crafted HTTP requests where the Node.js client omits certain headers from being visible to the proxy, while...

CLSA-2026-1792435669 TuxCare security update for @storybook/client-logger (1 CVE)

TuxCare rebuilt @storybook/client-logger to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

CVE-2026-98451

A flaw was found in the Linux kernel's SMB client. A local user can trigger this issue by opening an existing symbolic link or non-regular file on an SMB mount using file creation flags. Because the client improperly handles non-regular files during open operations, it fails to release directory...

CVE-2026-98454

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious SMB server can exploit this vulnerability by sending malformed create context responses to a connecting system. Because the client fails to properly validate record boundaries during response parsing, this issue c...

CVE-2026-98453

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious or compromised SMB server can trigger this vulnerability by returning malformed context responses during a file open operation. When the client fails to parse the context data, it aborts the operation without...

CVE-2026-98452

A flaw was found in the Linux kernel's Server Message Block SMB client. When opening cached directories, the client fails to validate server responses to compound commands before reading their contents and handling file identifiers. A malicious or compromised SMB server could exploit this flaw by...

CVE-2026-98523

A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem. A local user can cause a Denial of Service DoS by closing a DRM device file descriptor associated with a partially initialized client. Because the kernel fails to properly unregister an incomplete framebuffer client...

CVE-2026-98450

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability can lead to a Denial of Service DoS through resource exhaustion caused by unclosed remote file handles. When processing compound requests, an interrupted operation or synchronization failure causes previous...

CVE-2026-98449

A flaw was found in the Linux kernel's SMB Server Message Block client. This issue may allow a remote attacker or malicious server to trigger a Denial of Service DoS by inducing network transmission failures during compound request processing. Because the client releases its connection lock witho...

BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Crowd Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in version 7.2.0 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N...