CVE-2026-80525

CVE-2026-80525 affects the Linux kernel ASoC SOF ipc4-topology component. The ipc_config_data buffer for copier widgets is built once during ipc_prepare and cached for reuse. On suspend/resume , host and link DMA streams are re-allocated with potentially different stream tags, but the widget list...

CVE-2026-59189 OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep imag...

starlette-host-header-lab

Starlette Host-Header URL Confusion Lab X41-2026-002 Un laboratorio formativo containerizzato e autonomo che riproduce la vulnerabilità di bypass dell'autenticazione in Starlette, divulgata da X41 D-Sec. Advisory: X41-2026-002 GHSA: GHSA-86qp-5c8j-p5mr CWE: 436 — Conflitto di interpretazione /...

Security Bulletin: Security vulnerability has been found in IBM Verify Identity Access Digital Credentials (CVE-2026-16221)

Summary Security vulnerability has been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal...

The vulnerability of the btrfs/tree-log.c component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the btrfs/tree-log.c component in the Linux operating system’s kernel is related to improper handling of conflicting special elements. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-18246

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser...

CVE-2026-68102

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpupciremove calls drmdevunplug before invoking the driver fini routines. This causes drmdeventer in amdgputtmfini to always return false, so iounmapaperbasekaddr never runs on normal driv...

Linux Distros Unpatched Vulnerability : CVE-2026-68102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: fix aperture mapping leak amdgpupciremove calls drmdevunplug before invoking the driver fini routines. This causes drmdeventer in amdgputtmfini to...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

kernel security, bug fix, and enhancement update

5.14.0-687.34.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

Exploit for Interpretation Conflict in Wordpress

C...

kernel security update

5.14.0-687.33.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

CVE-2026-69192

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library...

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer...

Security Bulletin: MongoDB Enterprised Advanced affected by: Interpretation Conflict (CVE-2026-6322)

Summary There are vulnerabilities in fast-uri-3.0.1.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-6322. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encoded authority delimiters inside the ho...

kernel security update

4.18.0-553.148.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Interpretation Conflict

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing...

Interpretation Conflict

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached...

CVE-2026-66028 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement t...