CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

EEF-CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter...

PT-2026-83667

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity filter/3 built the update/destroy filter direct...

CVE-2026-82870: Authorization Bypass Through User-Controlled Key

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001482)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001482 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async PF workqueue when vCPU is being destroyed Always flush the per-vCPU asyn...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001012 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: release elements in clone only from destroy path Clone already always...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fixed the issue with rcudereferenceprotected. When destroying all sets, we are either in the pernetexit phase or executing a “destroy all sets” command from user space. The latter was taken into account in...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Ensure that the correct amount of memory is released during direct IO write operations. Running generic/406 causes the following warning in btrfsdestroy inode: this indicates that there are still outstanding extents...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Thermal: Core – The putdevice function should only be called after deviceregister fails. putdevice should not be called before a previous call to deviceregister. thermalcoolingdeviceregister does not follow this principle...

PT-2026-72749

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the vduse component. The vduse dev open function performs a lookup for struct vduse dev via the IDR and acquires dev-lock only after vduse lock has been...

CVE-2026-73221: Incorrect Authorization

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

CVE-2026-68424

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroyjoins mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat leads to a use after free. Fix this by moving mtdvirtconcatputmtddevices before...

CVE-2026-68423

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroy mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat after that leads to a use-after-free. Fix it by moving mtdvirtconcatputmtddevices...

CVE-2026-68191

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

UBUNTU-CVE-2026-68191

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

CVE-2026-68423

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroy mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat after that leads to a use-after-free. Fix it by moving mtdvirtconcatputmtddevices...

CVE-2026-68169

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

CVE-2026-68424 mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroyjoins mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat leads to a use after free. Fix this by moving mtdvirtconcatputmtddevices before...

CVE-2026-68424

CVE-2026-68424 affects the Linux kernel MTD virt_concat code. The root cause is a use-after-free: mtd_concat_destroy() frees item->concat, so calling mtd_virt_concat_put_mtd_devices(item->concat) can use freed memory. The fix migrates the call to mtd_virt_concat_put_mtd_devices() to occur b...

EUVD-2026-55610

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroyjoins mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat leads to a use after free. Fix this by moving mtdvirtconcatputmtddevices before...