CVE-2026-53378

A flaw was found in the Linux kernel's Direct Rendering Manager DRM color operation module drm/colorop. This vulnerability arises from improper reference tracking of blob properties during state duplication, destruction, and reset operations. An attacker with local access could potentially exploi...

CVE-2026-63983

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

CVE-2026-64120

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer dereference in phyreplysize In phypreparedata, several strings such as 'name', 'drvname', 'upstreamsfpname', and 'downstreamsfpname' are allocated using kstrdup. However, these allocations were not...

EUVD-2026-45805

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer dereference in phyreplysize In phypreparedata, several strings such as 'name', 'drvname', 'upstreamsfpname', and 'downstreamsfpname' are allocated using kstrdup. However, these allocations were not...

CVE-2026-63983 net/sched: fix packet loop on netem when duplicate is on

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

CVE-2026-63983

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

CVE-2026-63983 net/sched: fix packet loop on netem when duplicate is on

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

PT-2026-61300

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A packet loop occurs in the netem Network Emulator module when the duplicate feature is enabled. When netem duplicates a packet, it re-enqueues the copy at the root qdisc Queueing...

CVE-2026-62180

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61440. Reason: This candidate is a duplicate of CVE-2026-61440. Notes: All CVE users should reference CVE-2026-61440 instead of this candidate...

CVE-2026-11580

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

CVE-2026-11580 Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

EUVD-2026-44593

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

CVE-2026-11580

The CVE covers Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin prior to 2.4.17. The root cause is a missing per-object capability check in the post-duplication AJAX action, enabling users with Contributor-level access or higher to duplicate any post (regardless of owner, post t...

CVE-2026-11580

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...

CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware o...

GHSA-H444-6J9X-P8VH mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

When moving directories across filesystems, uutils mv dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a etclink - /etc inside the source becomes a full copy of /etc at the destination...

EUVD-2026-25012

mv: symlinks expanded during cross-device move resource exhaustion / data duplication...

CVE-2026-14761

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function rstrndup/rstrappend of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be...

CVE-2026-14761 radareorg radare2 str.c r_str_append integer overflow

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function rstrndup/rstrappend of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be...