PT-2026-89055

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causi...

CVE-2026-74388 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the share...

GHSA-GHRQ-5WPP-HXX5 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Summary A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic. Impact All wings users with an open SFTP port. Workarounds Close SFTP port...

CVE-2026-64281

CVE-2026-64281 affects the Linux kernel svcrdma transport (svc_rdma) where threads parked in svc_rdma_sq_wait() could hang indefinitely during transport teardown due to missing wakeups on close. The fixed flow adds svc_rdma_xprt_deferred_close(), which calls svc_xprt_deferred_close() and then wak...

Linux Distros Unpatched Vulnerability : CVE-2026-59850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already...

SUSE CVE-2026-59850

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions...

CVE-2026-59850

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. Mitigation Manually verify the channel is not closed inside your...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the channel data callbacks process when data packets are processed after a channel is closed. An attacker can cause a crash or trigger unintended behavior by sending data packets to a closed channel, resulting in the...

CVE-2026-63763

SurrealDB contains a privilege escalation via a confused deputy when unprivileged users (e.g., with editor role) create or modify fields containing futures, functions, or closures. These are executed in the context of the invoking user, allowing planted logic to run with higher permissions on rea...

vibesec-static

vibesec-static — static vulnerability auditor for Python A si...

RUSTSEC-2026-0198 `Report::frames_mut` allows aliased mutable references

Affected versions of this crate return an iterator from Report::framesmut whose &mut Frame items have lifetimes independent of the iterator, so all yielded references can be held at the same time. A yielded frame's sources are also yielded by the iterator and reachable through the parent frame vi...

CVE-2026-53358

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol implementation. This vulnerability arises from an incorrect order of acquiring locks during channel cleanup, which could lead to a race condition. This issue could potentially cause instability or...

CVE-2026-49432

A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service DoS condition, either by consumi...

CVE-2026-53193

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When sndtimer object is freed via sndtimerfree and still pending sndtimerinstance objects are assigned to the timer object, it tries to unlink all instances and just set NULL...

GHSA-CHGR-C6PX-7XPP PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures

PyCFunction::newclosure and the temporary newclosurebound complement in the 0.21–0.22 series required the supplied closure to be Send + 'static but not Sync. The resulting PyCFunction is a Python callable that can be invoked from any Python thread, which means the closure may be called concurrent...

PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures

PyCFunction::newclosure and the temporary newclosurebound complement in the 0.21–0.22 series required the supplied closure to be Send + 'static but not Sync. The resulting PyCFunction is a Python callable that can be invoked from any Python thread, which means the closure may be called concurrent...

Direct-Memory Resource Leak

RedisArrayAggregator is vulnerable to a direct-memory resource leak. The vulnerability is due to unreleased pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregation completes, which allows an attacker to repeatedly trigger connection churn and exhaust t...

RUSTSEC-2026-0177 Missing `Sync` bound on `PyCFunction::new_closure` closures

PyCFunction::newclosure and the temporary newclosurebound complement in the 0.21–0.22 series required the supplied closure to be Send + 'static but not Sync. The resulting PyCFunction is a Python callable that can be invoked from any Python thread, which means the closure may be called concurrent...

Missing `Sync` bound on `PyCFunction::new_closure` closures

PyCFunction::newclosure and the temporary newclosurebound complement in the 0.21–0.22 series required the supplied closure to be Send + 'static but not Sync. The resulting PyCFunction is a Python callable that can be invoked from any Python thread, which means the closure may be called concurrent...