The vulnerability of the ip6fl_seq_show() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the ip6flseqshow function in the Linux operating system is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Oracle Linux 9 : coreutils (ELSA-2026-28911)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28911 advisory. 8.32-41.0.1 - clean up empty file if cp is failed Orabug 15973168 9.5-8 - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification RHEL-180331...

PT-2026-52919

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the IOMMU subsystem. The group-domain pointer can be NULL if a default domain fails to allocate during the first probe. This leads to a system crash...

CVE-2026-53268

A flaw was found in the Linux kernel's netfilter conntrackirc module. This vulnerability allows for a possible out-of-bounds read. When parsing network traffic, if a command string is matched but subsequent parsing fails, the system does not properly exit, leading to the flaw. This could...

GO-2026-5647 free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) in github.com/free5gc/nef

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure attacker-controlled notifyUri in github.com/free5gc/nef...

GO-2026-5546 Oxia exposes bearer token in debug log messages on authentication failure in github.com/oxia-db/oxia

Oxia exposes bearer token in debug log messages on authentication failure in github.com/oxia-db/oxia...

GO-2026-5505 Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization in github.com/portainer/portainer

Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2026-40702

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead t...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the RemoveAll process during upload failure-cleanup. An attacker can delete files outside their authorized directory by leveraging a symlink within their permitted scope, thereby bypassing intended access...

GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...

GO-2026-5177 Ella Core Panics Upon NGAP handover failure in github.com/ellanetworks/core

Ella Core Panics Upon NGAP handover failure in github.com/ellanetworks/core...

CVE-2026-52954

A flaw was found in the Linux kernel's libceph component. A remote attacker could send a specially crafted CEPHMSGOSDMAP message containing a corrupted CRUSH map. If this map includes two crushchooseargmaps with identical indices, it triggers an assertion failure, leading to a kernel bug and a...

CVE-2026-53102

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability, a memory leak, occurs when the mt76connacmcuallocstareq function allocates a socket buffer skb that is not properly freed if subsequent operations, such as mt76connacmcustawedupdate or mt76connacmcustakeytlv, fail. This...

CVE-2026-53261

A flaw was found in the devlink component of the Linux kernel. This issue occurs when a devlink instance acquires a nested relation but fails to register, leading to a resource leak. This can result in system instability or a denial of service DoS over time due to resource exhaustion...

CVE-2026-55667 File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope other tenants' data, a...

CVE-2026-55667

File Browser CVE-2026-55667 allows a scoped, non-admin user with only Create permission to delete files outside their scope during failed-upload cleanup. The issue stems from ScopedFs.RemoveAll bypassing the symlink guard that other methods enforce, with the direct-upload cleanup path invoking Re...

CVE-2026-52690

CVE-2026-52690 affects the PowerDNS Recursor. Spoofed replies can cause an authoritative server’s IP to be marked as not supporting EDNS, leading to DNSSEC validation failures for records served by that server. The vulnerability’s impact is documented as enabling validation failures in the presen...

EUVD-2026-39360

Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail...

CVE-2026-53261

In the Linux kernel, the following vulnerability has been resolved: devlink: Release nested relation on devlink free devlink relation state is normally released from devlunregister, which calls devlinkrelput. This misses devlink instances that get a nested relation before registration and then fa...

CVE-2026-53268

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrackirc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This helper should be deprecated, given...