CVE-2026-74684: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74728: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called with bp-baddr still NULL. The code falls through to the folioput path which calls virttofolioNULL, dereferencing an invalid address and...

CVE-2026-74666: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

CVE-2026-74633: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

Linux Distros Unpatched Vulnerability : CVE-2026-76905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go...

Linux Distros Unpatched Vulnerability : CVE-2026-74585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Bound the DROM dual link port number before indexing sw-ports tbdromparseentryport validates the device-supplied header-index against...

Linux Distros Unpatched Vulnerability : CVE-2026-74726

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via...

Linux Distros Unpatched Vulnerability : CVE-2026-74610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does no...

Linux Distros Unpatched Vulnerability : CVE-2026-74728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: xfs: handle NULL baddr in xfsbuffree When xfsbufallocbackingmem fails, xfsbuffree is called...

Linux Distros Unpatched Vulnerability : CVE-2026-74684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 net: tap: NULL pointer derefence in devparseheaderprotocol when...

CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

DEBIAN-CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

Summary A nil-pointer dereference in openapi3filter.ConvertErrors lets any unauthenticated client crash a server with a single HTTP request. When an application validates a multipart/form-data request body and renders the resulting validation error through the library-provided...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in convertParseError in openapi3filter/validationerrorencoder.go. An attacker can crash a server by sending a malformed multipart/form-data request body that triggers validation and is rendered through...

EUVD-2026-64150

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-76905

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CLSA-2026-1787307395 kernel: Fix of 83 CVEs

net/sched: serialize qdiscrtablist against concurrent get/put CVE-2026-68138 - staticcall: Replace pointless WARNON in staticcallmodulenotify CVE-2024-49954 - staticcall: Handle module init failure correctly in staticcalldelmodule CVE-2024-50002 - smb: client: require a full NFS mode SID before...

CVE-2026-56288

A flaw was found in GNU patch. An attacker can exploit this by providing a specially crafted patch file, which leads to a NULL pointer dereference. This improper handling of end-of-file markers can corrupt internal data structures, causing the utility to crash. This results in a denial of service...

CVE-2026-50812

A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users...