CVE-2026-74688

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

CVE-2026-74621

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-74620

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

EUVD-2026-64387

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...

CVE-2026-74688 sctp: clear control chunk transport if it is being removed

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

CVE-2026-74688

A use-after-free vulnerability in the Linux kernel's SCTP implementation. The function sctp_make_heartbeat_ack() caches a destination transport pointer without taking a reference. When src_out_of_asoc_ok is enabled, a HEARTBEAT ACK may remain queued on control_chunk_list. If the peer transport is...

EUVD-2026-64375

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

CVE-2026-74688 sctp: clear control chunk transport if it is being removed

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

CVE-2026-74620

This Linux kernel vulnerability affects the net/sched subsystem, specifically the act_gact and act_police traffic control actions. The fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) bypass the range check in tcf_action_check_ctrlact(), allowing user space to store TC_ACT_C...

EUVD-2026-64557

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

CVE-2026-74595 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-74595 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

EUVD-2026-64532

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

CVE-2026-76603

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

EUVD-2026-64322

Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-77992

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are affected by a heredoc terminator breakout in the calc element . The root cause is that the onUpdateComment endpoint did not perform any access checks, allowing unauthenticated network-based attacks with low complexity and no ...

CVE-2026-76600 Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

EUVD-2026-64319

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.3 - ???...

CVE-2026-76607 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-76609 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...