CVE-2026-98844: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

Linux Distros Unpatched Vulnerability : CVE-2026-98681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplockbreakcancelled, offload, and statusfiledeleted field...

Linux Distros Unpatched Vulnerability : CVE-2026-98843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side...

Linux Distros Unpatched Vulnerability : CVE-2026-98684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in...

PT-2026-116902

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3 zero range emulates FALLOC FL ZERO RANGE by invalidating the page cache over the target range with truncate pagecache range and then issuing FSCTL SET ZERO DATA to the...

PT-2026-116903

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC FL KEEP SIZE fallocate emulation for small interior ranges in smb3 simple fallocate range issues FSCTL QUERY ALLOCATED RANGES and zero-fills...

CVE-2026-98683: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98684: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in smb3simplefallocaterange issues FSCTLQUERYALLOCATEDRANGES and zero-fills any...

CVE-2026-98728: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

CVE-2026-98479: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

Linux Distros Unpatched Vulnerability : CVE-2026-98683

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with...

Security update for ntfs-3g_ntfsprogs (moderate)

openSUSE security update: security update for ntfs-3gntfsprogs ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22053-1 Rating: moderate References: bsc1281756 bsc1281757 bsc1281758 bsc1281759 bsc1281760 bsc1281761 bsc1281762 bsc1281763 Affected...

CVE-2026-98551: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

curl: CVE-2026-111954: upload reader failed redirect UAF

Summary: Curlreqhardreset lib/request.c line 124 in curl-8230 calls Curlclientreset while req-rewindread may still be set, which keeps the client reader stack for a rewind lib/sendf.c line 82, and only clears the flag at line 157, so the kept stack is never rewound or freed and is still installed...

CVE-2026-111929

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111919

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111914

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

CVE-2026-111905

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111889

phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read...

CVE-2026-111884

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...