The vulnerability of the f2fs_rename() function in the fs/f2fs/namei.c file of the F2FS file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the f2fsrename function in the fs/f2fs/namei.c file of the F2FS file system in the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Amazon Linux 2 : containerd, --advisory ALAS2ECS-2026-130 (ALASECS-2026-130)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-130 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN...

PYSEC-2026-1582 loggingredactor converts non-string types to string types in logs

Impact Non-string types are converted into string types, leading to type errors in %d conversions. Patches The problem has been patched in version 0.0.6. Workarounds None without patching. Resources Issue report: https://github.com/armurox/loggingredactor/issues/7 Release:...

CVE-2026-10659

The Dhara flash translation layer disk driver drivers/disk/ftldhara.c implemented the dharanand callbacks so that, on a flash error, the error code was written unconditionally through the caller-supplied dharaerrort err pointer e.g. err = DHARAEECC in dharanandread, and similar in...

PYSEC-2026-1181 Apache Superset: Improper error handling on alerts

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert...

The vulnerability of the dwc3_host_init() function in the drivers/usb/dwc3/host.c file of the driver module allows a hacker to cause a service failure in the DesignWare USB3-based controller-based Linux operating system.

The vulnerability of the dwc3hostinit function in the drivers/usb/dwc3/host.c file of the DesignWare USB3 controller support driver in the Linux operating system is related to initialization errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

GHSA-4X34-CHG5-MWJJ chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)

In Chmoder::chmod the recursive branch overwrites the running result instead of accumulating it, so the exit code reflects only the last file processed: if self.recursive r = self.walkdirwithcontextfile, true; // overwrites r else r = self.chmodfilefile.andr; PoC: GNU returns 1 when a file fails;...

rabbitmq: RabbitMQ: Authorization bypass allows unauthorized topic writes and binds during metadata-store failures

A flaw was found in RabbitMQ, a messaging and streaming broker. During metadata-store failures, the topic authorization mechanism can incorrectly allow restricted topic writes and binds. This occurs because permission lookup errors from Khepri are treated as an 'allow' condition by the internal...

OESA-2026-2821 nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

PYSEC-2026-784 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...

ROS-20260706-73-0061

The vulnerability in python-virtualenv is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper error handling in the pre-receive process when processing input with bufio.Scanner. An attacker can bypass branch-protection checks by submitting oversized input that triggers scanner errors...

CVE-2026-27780

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks...

CVE-2026-27780 Gitea pre-receive hook can miss branch-protection checks after scanner errors

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks...

PT-2026-55605

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.0 Description The software does not fail closed when encountering bufio.Scanner errors during the processing of pre-receive hook input. This behavior allows oversized input to bypass branch-protection checks...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to execute arbitrary code.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

MAL-2026-6719 Malicious code in ts-clob-math-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9 On npm install, the postinstall script scripts/install-check.cjs resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.ap...

PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions

A flaw was found in PHP. Some functions, including urldecode, incorrectly pass signed characters to character type ctype functions. On certain systems, this can lead to accessing memory with a negative offset. This vulnerability can be exploited by an attacker to trigger a denial of service DoS,...

Vulnerability of the dmc620_pmu_init() function in the drivers/perf/arm_dmc620_pmu.c module of the Linux kernel’s performance monitoring driver, which allows a hacker to cause a system failure.

The vulnerability of the dmc620pmuinit function in the drivers/perf/armdmc620pmu.c module of the Linux kernel’s performance monitoring driver is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a system failure...