CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100722

The vm2 library before version 3.12.2 is vulnerable to a host process termination due to a flaw in the sandbox-to-host construct trap . Specifically, the BaseHandler fails to apply host-side Promise rejection handling when the apply trap calls markHostPromiseHandled() on a returned value, while t...

CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

PT-2026-98057

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access construct region reads cxled-part and uses it to index cxlds-part without checking for a negative value. If the partition was never resolved, part remains at its initial...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed a memory leak in cifsconstructtcon When using a multiuser mount with domain= specified and cifscreds, cifssetcifscreds will set @ctx-domainname, so it needs to be freed before leaving cifsconstructtcon. This...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

CVE-2026-80843

Linux kernel IPsec transform (xfrm) subsystem is affected by a memory leak in xfrm_state_construct() . When an authentication algorithm with no sadb_alg_id (e.g., cmac(aes) ) is selected, attach_auth_trunc() allocates x->aalg but leaves x->props.aalgo at zero. The subsequent call to attach_...

CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

CVE-2026-45537

OpenSIPS contains a buffer overflow in construct_uri() used to assemble SIP URIs. In versions before 3.6.6 and 4.0.0-rc1, components (protocol, username, domain, port, params) are concatenated into a fixed 1024-byte global BSS buffer without bounds checks. If a routing script supplies a long, att...

CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +615 more potentially affected by CVE-2026-13760 via aws-cdk-lib (>=2.0.0, <=2.259.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-13760 Source advisory: OSV:GHSA-VCRF-J523-4MRF...

CVE-2026-43466

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5eresettxqsqccpc resets dmafifocc to 0 but not dmafifopc, desyncing the DMA FIFO producer and consumer. After...

CVE-2026-43466

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5eresettxqsqccpc resets dmafifocc to 0 but not dmafifopc, desyncing the DMA FIFO producer and consumer. After...

CVE-2026-31529

A flaw was found in the Linux kernel's cxl/region component. This vulnerability involves a resource leakage within the constructregion function. When sysfsupdategroup fails, the resource is not explicitly freed, leading to a memory leak. This could potentially allow a local attacker to cause a...

CVE-2026-31529

The CVE-2026-31529 issue affects the Linux kernel in the cxl/region code path. The vulnerability is a leakage (resource/memory) in __construct_region(): if sysfs_update_group() fails, the resource isn’t explicitly freed, which can lead to leakage. Several sources confirm the fix and describe the ...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011405)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011405 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix memory leak in cifsconstructtcon When having a multiuser mount with domain=...

JLSEC-2026-155

In libass 0.14.0, the assoutlineconstruct's call to outlinestroke causes a signed integer overflow...

OSV-2026-461 UNKNOWN READ in XRef::constructObjectEntry

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=495914144 Crash type: UNKNOWN READ Crash state: XRef::constructObjectEntry XRef::constructXRef XRef::XRef...