PT-2026-72297

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm thin metadata handling where the functions reserve metadata snap and release metadata snap modify the superblock's held root directly within the block manager's...

PT-2026-73024

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the btrfs zoned filesystem during metadata writeback and transaction commit. The btree writepages function holds the fs info-zoned meta io lock throughout the...

CVE-2026-74358: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of iflags, and ext4testinodestate applies the corresponding +32 offset. The fast-commit wait and wake paths...

PT-2026-72794

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 file system on 64-bit systems regarding the mapping of fast commit wait and wake bits. Dynamic inode states are stored in the upper half of i flags, and the...

Linux Distros Unpatched Vulnerability : CVE-2026-74318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: fix deadlock cloning inline extent when using flushoncommit In commit b48c980b6a7e btrfs: fix deadlock between reflink and transaction commit when using...

PT-2026-72413

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the jbd2 journal initialize fast commit function. The issue occurs during journal capacity validation when calculating the difference between j last and nu...

PT-2026-72366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Linux kernel when a commit operation fails within the DAMON Data Access Monitoring core. The damon commit target function manages source and destination targe...

CVE-2026-47191

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191

CVE-2026-47191 affects the kas setup tool for BitBake-based projects. Before version 5.3, reliant on a git commit ID (SHA-1/SHA-256) to validate repository state could mislead users into checking out a branch with the same name, potentially indicating a repository takeover. The primary impact con...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

EUVD-2026-58719

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191: Improper Verification of Cryptographic Signature

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

zizmor v1.30.0-rc1

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

SUSE CVE-2026-45022

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git's decoded representation may expose...

CVE-2026-18709 Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161

CVE-2026-48161 affects react18-use (a React 19 use hook shim). Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits that added src/install.js and wired it into postinstall, which fetched a JavaScript payload from an attacker-controlled HTTPS endpoint...