CVE-2026-64574

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...

CVE-2026-64574 wifi: mac80211: tear down new links on vif update error path

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...

CVE-2026-64574

CVE-2026-64574 affects the Linux kernel’s wifi mac80211 subsystem. When ieee80211_vif_update_links() adds new links and drv_change_vif_links() fails, new link debugfs entries may still point to freed memory, causing a use-after-free in ieee80211_if_read_link() and a potential local denial-of-serv...

CVE-2026-64574

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...

CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64572

CVE-2026-64572 affects the Linux kernel's IPv4 FIB path. In fib_table_insert(), new_fa is published to the leaf’s fa_list before notifiers run; if a notifier fails, the code removes new_fa via fib_remove_alias() and frees it with kmem_cache_free(). A concurrent, already-reached reader in fib_tabl...

CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-67590

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67552

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...

CVE-2026-70378

imagecli's carve pipeline operation Carve::apply in src/imageops.rs only asserts ratio = 1.0, never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to...

CVE-2026-61486

A Stack-based Buffer Overflow vulnerability exists in the JSON parser error reporter of Apache Lucy when processing malformed input. This issue affects all versions of Apache Lucy, but notably only impacts products no longer supported by the maintainer. Because the project is retired, the maintai...

phpstan v2.2.8

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

Origin Validation Error

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Origin Validation Error in the IdP-initiated broker endpoint. An attacker who controls a linked upstream SAML...

The vulnerabilities of the functions pkcs7_decrypt_smime(), pkcs7_decrypt_pem(), and pkcs7_decrypt_der in the Python programming language-based cryptography library allow attackers to compromise the confidentiality of protected information.

The vulnerabilities of the functions pkcs7decryptsmime, pkcs7decryptpem, and pkcs7decryptder in the Python programming language-based cryptography library are related to deficiencies in the error reporting mechanism. Exploiting these vulnerabilities could allow an attacker to influence the...

CVE-2026-52466

Open Library Foundation VuFind versions v11.0.3 and v4.1 are vulnerable to Incorrect Access Control . The vulnerability exists in the VuFind echt Controller AbstractBase::validateAccessPermission method, where the application fails to terminate processing after identifying that controller-level p...

PT-2026-68230

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description An issue in the Simple Network Management Protocol SNMP subsystem allows an authenticated remote attacker to cause a device to reload, leading to a denial of service DoS...

📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection

A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...