CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents allows a intruder to gain full control over the system.

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow an attacker to gain full control over the...

The vulnerability of the change_page_attr() function in the arch/powerpc/mm/pageattr.c module, which is part of the PowerPC platform support in the Linux operating system, allows a hacker to cause a service failure.

The vulnerability of the changepageattr function in the arch/powerpc/mm/pageattr.c module of the PowerPC platform in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the Win32k.sys component in Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the Win32k.sys component in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to gain increased privileges...

PT-2026-66595

Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions 8.0.0-next.0 through 8.2.0 AdonisJS HTTP Server versions 9.0.0 through 9.0.2 Description The default HTML renderer interpolates the error.message variable directly into the HTML exception response without proper...

The vulnerability of the msm_gem_free_object() function in the drivers/gpu/drm/msm/msm_gem.c module of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the msmgemfreeobject function in the drivers/gpu/drm/msm/msmgem.c module of the Direct Rendering Infrastructure DRI driver for the Linux operating system is related to state management errors. Exploiting this vulnerability could allow a remote attacker to compromise the...

The vulnerability of the nfs_match_client() function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the nfsmatchclient function in the fs/nfs/client.c module, which is part of the NFS client support in Linux kernel, is related to authentication errors. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerabilities of the functions l2cap_register_user() and l2cap_unregister_user() in the net/bluetooth/l2cap_core.c module of the Linux kernel’s Bluetooth subsystem allow a malicious actor to cause service failures.

The vulnerability of the functions l2capregisteruser and l2capunregisteruser in the net/bluetooth/l2capcore.c module of the Linux kernel’s Bluetooth subsystem is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow a attacker to cause service...

The vulnerability of the seg6_build_state() function in the net/ipv6/seg6_iptunnel.c module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the seg6buildstate function in the net/ipv6/seg6iptunnel.c module of the Linux kernel is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

RLSA-2026:33449 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via improper handling of signed characters in ctype...

CVE-2026-58182

The issue CVE-2026-58182 affects Apache Traffic Server via the ts_lua plugin, which mishandles initialization, transform context, and per-instance state. Affects ATS versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The available fix is to upgrade to ATS 9.2.15 or 10.1.4, which address the v...

CVE-2026-58182 Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58182 Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58163 Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...

CVE-2026-58163 Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...

CVE-2026-58163

CVE-2026-58163 (Apache Traffic Server) : The issue arises from mishandling on-disk cache fields and object lifetimes, leading to state corruption or crashes. Affected versions are 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upstream fixes are available in 9.2.15 and 10.1.4. If you rely on these...

CVE-2026-58163 Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...

CVE-2026-58159 Apache Traffic Server: Listener and ACL handling allow access-control bypass

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix...

EUVD-2026-50212

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix...

CVE-2026-58159 Apache Traffic Server: Listener and ACL handling allow access-control bypass

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix...