CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-64461

A flaw was found in the Linux kernel's MediaTek PCIe driver. When a Peripheral Component Interconnect Express PCIe port fails to enable, the associated Interrupt Request IRQ domains are not properly released. This resource leak can accumulate over time, potentially leading to a denial of service...

CVE-2026-64376

A flaw was found in the Linux kernel's firmware loader component. This vulnerability occurs in the firmwareuploadregister function when an allocation failure happens after a device instance is created. The system fails to properly release a device reference, leading to an unbalanced reference...

CVE-2026-42792

A flaw was found in Erlang OTP's Erlang Port Mapper Daemon epmd. An unauthenticated remote attacker can exploit an improper handling of exceptional conditions in the doaccept function. By exhausting connection slots through holding numerous TCP connections open and periodically sending data, the...

UBUNTU-CVE-2026-18220

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend bfd/elf32-dlx.c in GNU binutils. The dlxrtypetohowto function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values via...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

UBUNTU-CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100

Apache Traffic Server HPACK issue: the encoder updates its dynamic table before the header block is confirmed, causing desynchronization with the decoder after a failed encode. This can corrupt subsequent header blocks on a connection. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. ...

EUVD-2026-50235

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-65100 Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-64297

A flaw was found in the Linux kernel. An unchecked return value in the moduleextendmaxpages function within the module decompression logic can lead to a null pointer dereference. This vulnerability can be triggered if memory allocation fails during module loading, resulting in a kernel oops. This...

PT-2026-65768

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

PT-2026-65695

The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A...

The vulnerability of the nft_ct_helper_obj_eval() function in the net/netfilter/nft_ct.c module of the netfilter component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the nftcthelperobjeval function in the net/netfilter/nftct.c module of the netfilter component of the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the __folio_split() function in the mm/huge_memory.c module of the Linux kernel’s memory management subsystem allows a hacker to trigger a system failure.

The vulnerability of the foliosplit function in the mm/hugememory.c module of the Linux kernel’s memory management subsystem is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...