CVE-2026-80986

CVE-2026-80986 affects the Linux kernel's SMC-Rv2 (Shared Memory Communications over RDMA v2) network subsystem. The flaw is in smc_llc_save_add_link_rkeys() : when a link's device has max_recv_sge == 1 , the v2 extension is read from offset 68 of a 72-byte slab allocation, so ext->num_rkeys a...

CVE-2026-88053 Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATAINTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validati...

CVE-2026-87810

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from results but returns unfiltered match counts. Unauthenticated publish-mode readers can submit arbitrary search terms to learn whether matching...

CVE-2026-87810

Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint. While the endpoint filters private blocks from returned results, it returns unfiltered match counts , allowing unauthenticated publish-mode readers to submit arbitrary searc...

CVE-2026-80569

A flaw was found in the synaptics-rmi4 driver within the Linux kernel. A malicious or malfunctioning RMI4 device can exploit this vulnerability by reporting incorrect electrode counts. This leads to the driver attempting to write data beyond the allocated memory buffer, causing memory corruption...

AZL-97803 CVE-2026-80569 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmif54work reads a diagnostics report from the device into f54-reportdata, sizing the transfer with rmif54getreportsize: reportsize = rmif54getreportsizef5...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in the X.Org server. Both DeviceFocusEvent and XIQueryPointer responses contain a bit for each logical button that is currently active. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server only allocates space for the specific number of buttons on...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fixed a crash that occurred when setting the number of CPU cores to an odd number. When the number of CPU cores is adjusted to 7 or other odd numbers, the size of the zones becomes an odd number. The addresses of thes...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PM /devfreq: rk3399dmc: Disabled edev upon removal Otherwise, we encountered an unhandled enable-count when unbinding the DFI device: 1279.659119 ------------ Cut here ------------ 1279.659179 WARNING: CPU: 2 PID: 5638 at...

CVE-2026-68206

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

CVE-2026-68206 media: v4l2-ctrls: validate HEVC active reference counts

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

CVE-2026-68206

The CVE-2026-68206 entry pertains to the Linux kernel, specifically the media: v4l2-ctrls path for HEVC, where the common validation of slice parameters did not verify active L0/L1 reference counts before driver-specific code ran. Red Hat, Ubuntu, Debian, NVD, and other sources describe a flaw th...

EUVD-2026-55307

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

PT-2026-80176

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.34.8-1.1 Description A memory-amplification denial of service occurs due to unvalidated DNS header record counts. This allows an attacker to cause excessive memory consumption by manipulating the record counts in DNS...

GHSA-RVMM-V933-JGXQ Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

EUVD-2026-52909

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file'...

CVE-2026-54332

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against...

Important: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...