PT-2026-64764

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.1 Description In the userspace dynamic-objects subsystem, the thread idx alloc function in kernel/userspace/userspace.c allocates a new thread permission index from the global thread idx map bitmap without holding...

PT-2026-64739

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access occurs in the tcp ao established key function when it is called from tcp v46 timewait ack using a twsk TCP time-wait socket. This happens because the lockdep sock...

PT-2026-64759

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the Samsung serial driver when console flow control is enabled via UPF CONS FLOW. The issue arises because the functions s3c24xx serial stop tx and s3c24xx serial...

Linux Distros Unpatched Vulnerability : CVE-2026-64490

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device- provided control type and value count returned by the...

Linux Distros Unpatched Vulnerability : CVE-2026-64459

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: restore RCU grace period in tcpaodestroysock Commit 51e547e8c89c tcp: Free TCP-AO/TCP-MD5 info/keys without RCU removed the callrcu callback from...

PT-2026-64760

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qat adf ctl with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any publi...

Linux Distros Unpatched Vulnerability : CVE-2026-64398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after...

PT-2026-64609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Ownership and group modifications were ignored when mounting with SMB3 POSIX Extensions, unless CIFS MOUNT CIFS ACL or CIFS MOUNT MODE FROM SID were explicitly set. The issue occurs with...

Linux Distros Unpatched Vulnerability : CVE-2026-64422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is...

PT-2026-64505

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM x86 module where fastpath userspace exits may occur before the vendor's exit handler runs. This prevents KVM from executing vendor-specific operations required...

Linux Distros Unpatched Vulnerability : CVE-2026-64280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: dfl-afu: validate DMA mapping length in afudmamapregion afuioctldmamap accepts a 64-bit length from userspace via DFLFPGAPORTDMAMAP ioctl without an upper...

Linux Distros Unpatched Vulnerability : CVE-2026-55708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree fo...

GHSA-MHVJ-JHPQ-885V blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...

CVE-2026-60135

An attacker can modify data that should be restricted to read‑only access...

GHSA-RM67-G9CH-VXFF Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Affected software - Product: Poweradmin web front-end for PowerDNS - Version tested: master, commit 7f28c3a97 also reachable in the 4.x release line — the record-edit code is the same - Component: record editing web UI - Vulnerability type: Broken Access Control / Insecure Direct Object Reference...

EUVD-2026-48369

swift-nio-http2: Missing CR/LF/NUL validation in header values...

GHSA-P279-2CQP-84JG OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

GHSA-4QCJ-M5WP-JMF4 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

GHSA-W8X7-H2PX-XMQ8 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...