Linux Distros Unpatched Vulnerability : CVE-2026-74362

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ext2: fix ignored return value of genericwritesync Fix ext2diowriteiter to propagate the...

Linux Distros Unpatched Vulnerability : CVE-2026-72319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP...

Linux Distros Unpatched Vulnerability : CVE-2026-74380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu: host1x: Fix iommumapsgtable return value check Commit iommu: return full error code from iommumapsgatomic changed iommumapsgtable to return an ssizet and...

CVE-2026-19500: Uncontrolled Resource Consumption

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing th...

CVE-2026-74962: Origin Validation Error

Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74963: Origin Validation Error

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74981: Origin Validation Error

Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Linux Distros Unpatched Vulnerability : CVE-2026-72421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly ...

Linux Distros Unpatched Vulnerability : CVE-2026-72138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xen/gntdev: fix error handling in ioctl When gntdevioctlmapgrantref fails to copy the operation result back to userspace after successfully adding the mapping t...

Linux Distros Unpatched Vulnerability : CVE-2026-72406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: sungem: fix probe error cleanup geminitone calls gemremoveone when registernetdev fails. gemremoveone unregisters and frees resources owned by the netdevic...

MiracleLinux 8 : dracut-049-246.git20260728.el8_10 (AXSA:2026-1556:05)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1556:05 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-74384

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node...

CVE-2026-72119

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing...

ANT-2026-A5580GNM · xdao · logic-error

logic-error WITHDRAWN This report was withdrawn after publication. The original commitment below remains in the ledger, and the identifying fields published before the withdrawal are kept as they were first published. Note, 2026-10-02. This page showed the full report from 2026-08-26 until...

ANT-2026-KRKYEBGE · nftables · write-primitive

type-confusion high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Opus 4.6 REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-KRKYEBGE: write-primitive in nftables In jsonparsemapstmt, the...

CVE-2026-72067

A flaw was found in the Linux kernel's CPU hotplug mechanism. When the cpuhpinvokecallback function attempts to unwind previous operations after a failure, it can incorrectly reuse a return value. This issue allows a successful rollback to mask the original error, causing a failed CPU hotplug...

ANT-2026-CEP8Y9M0 · ffmpeg · Use-After-Free

use-after-free high Severity Claude high · Security research firm - · Maintainer - REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CEP8Y9M0: avformat/mpegts: reset PES state before JPEG-XS error return In the MPEG-TS demuxer, newpespacket begins transferring ownership of...

GHSA-92HR-GMR6-H8CP Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR 7906 ether/etherpad. A set of medium/low hardening fixes: - Weak RNG for tokens CWE-330: author/session/readonly IDs were generated with Math.random client and server. Now use crypto.getRandomValues. - Login timing / no failure delay CWE-208/CWE-307: the OIDC interaction login used a...

ANT-2026-MAPZGQDY · jsoncons · Heap-buffer-overflow

oob-write high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-MAPZGQDY: Heap-buffer-overflow in bigint.hpp:260 During a...

Arbitrary Code Injection

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection through the handleException function, which fails to sanitize the .cause property of errors. An attacker can...