CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2023:1693424916)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2023:1693424916 advisory. - A use-after-free exists in drivers/tee/teeshm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.29 has a security vulnerability. This vulnerability stems from the fact that the Data-In branch of iscsitcphdrdissect does not check the data direction. As a result, data provided by the target may be written into the page that the initiator is about to send, causing...

Linux Distros Unpatched Vulnerability : CVE-2026-98755

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field...

Linux Distros Unpatched Vulnerability : CVE-2026-98683

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with...

CVE-2026-98684: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in smb3simplefallocaterange issues FSCTLQUERYALLOCATEDRANGES and zero-fills any...

PT-2026-116929

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945 pci probe calls il eeprom init, which allocates memory for the EEPROM data. The probe failure paths release this allocation with il eeprom free, but the remove path does not...

Security update for ntfs-3g_ntfsprogs (moderate)

openSUSE security update: security update for ntfs-3gntfsprogs ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22053-1 Rating: moderate References: bsc1281756 bsc1281757 bsc1281758 bsc1281759 bsc1281760 bsc1281761 bsc1281762 bsc1281763 Affected...

curl: CVE-2026-111954: upload reader failed redirect UAF

Summary: Curlreqhardreset lib/request.c line 124 in curl-8230 calls Curlclientreset while req-rewindread may still be set, which keeps the client reader stack for a rewind lib/sendf.c line 82, and only clears the flag at line 157, so the kept stack is never rewound or freed and is still installed...

CVE-2026-111929

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111919

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111914

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventorydata.php that allows authenticated users to bypass the inventorymoduleenabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory ite...

CVE-2026-111905

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

CVE-2026-111889

phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read...

CVE-2026-111884

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111929

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

EUVD-2026-103296

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919

Vikunja versions 0.22.0 before 2.7.0 are vulnerable to an improper access revocation flaw regarding webhooks. The root cause allows removed collaborators to continue receiving project data, specifically task titles and descriptions , via webhooks they created prior to their removal. This includes...

EUVD-2026-103287

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...

CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after...