11427 matches found
ROS-20260918-73-0061
The vulnerability of the Linux operating system’s kernel is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...
Linux Distros Unpatched Vulnerability : CVE-2026-90086
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set...
CVE-2026-53557
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
EUVD-2026-82564
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
DEBIAN-CVE-2026-93157
In the Linux kernel, the following vulnerability has been resolved: hwrng: xilinx-trng - propagate timeout before any data is read xtrngreadblock32 polls for 16-byte chunks but returns the number of bytes read even when the first poll times out. Its caller then treats a zero return as a short...
CVE-2026-90369
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...
DEBIAN-CVE-2026-90369
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...
DEBIAN-CVE-2026-90086
In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...
CVE-2026-90086
In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...
DEBIAN-CVE-2026-90051
In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...
CVE-2026-90369 wifi: mt76: fix out-of-bounds access in mmio copy helpers
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...
CVE-2026-90369
This Linux kernel vulnerability affects the mt76 Wi-Fi driver's MMIO copy helpers. The functions mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to ALIGN(len, 4), causing an out-of-bounds access when the length is not a multiple of four: write_copy reads past the source buffer and rea...
CVE-2026-90369 wifi: mt76: fix out-of-bounds access in mmio copy helpers
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76mmiowritecopy and mt76mmioreadcopy iterate up to ALIGNlen, 4, so a length that is not a multiple of four reads past the source buffer writecopy or writes past the...
CVE-2026-90086 xsk: honor XDP_TX_METADATA in zero-copy path
In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...
CVE-2026-90086
CVE-2026-90086 affects the Linux kernel AF_XDP (xsk) zero-copy TX path . The root cause is that the zero-copy path reads TX metadata whenever the UMEM has metadata space, even when the descriptor does not set the XDP_TX_METADATA flag. The fix passes descriptor options through the metadata helpers...
EUVD-2026-81947
In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...
CVE-2026-90051 tcp: reject non zerocopy devmem tx
In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...
CVE-2026-90051 tcp: reject non zerocopy devmem tx
In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...