8897 matches found
SUSE CVE-2026-89699
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
CVE-2026-89699
A flaw was found in the Linux kernel's Network File System Daemon nfsd when handling NFSv4 CREATE operations. A remote attacker can exploit this by sending a crafted request with an oversized symbolic link symlink target length. This unbounded length can force the kernel to allocate a large amoun...
CVE-2026-68535
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...
AZL-100310 CVE-2026-89699 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
UBUNTU-CVE-2026-89699
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
CVE-2026-89693
In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...
EUVD-2026-76688
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...
CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...
CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...
CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions
Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...
CVE-2026-68535
Concrete CMS versions 9.2.0 through 9.5.2 are affected by a missing authorization check in the Area REST API block-create endpoint. The endpoint failed to invoke the block type controller's validate() method, which is responsible for authorizing referenced files against the user's file-manager vi...
EUVD-2026-76611
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
CVE-2026-89699
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
CVE-2026-89699
CVE-2026-89699 is a denial-of-service vulnerability in the Linux kernel's nfsd (Network File System Daemon). The function nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for NFSv4 symlink targets, allowing a remote, unauthenticated attacker to force a kmalloc of up to several ...
CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...
EUVD-2026-76605
In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...
CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...
CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdrdecodesattr: iap-iaatime.tvnsec = tmp2 NSECPERUSEC; tmp2 is a u32 and NSECPERUSEC is 1000, so t...