CVE-2026-98133

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

CVE-2026-97547: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-97547

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-98133: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

Linux Distros Unpatched Vulnerability : CVE-2026-98133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path...

PT-2026-98487

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system when exchanging two full-file ranges. The function xmi can exchange reflink flags may incorrectly move the reflink inode flag between files when XF...

kernel: ipvs: do not propagate one-packet flag to synced conns

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...

libxml2: Fix of 2 CVEs

CVE-2026-86143: reject buffer lengths at or above INTMAX before calling the output write callback to prevent an integer overflow - CVE-2026-86144: propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree so parser flags such as XMLPARSENONET are honoured...

kernel: ipvs: do not propagate one-packet flag to synced conns

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...

kernel: ipvs: do not propagate one-packet flag to synced conns

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...

PT-2026-98064

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xhci component where new commands could be queued on the command ring even when the xHC is marked as inaccessible. This state is managed by the HCD FLAG HW...

PT-2026-104949

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCD FLAG HW ACCESSIBLE. HCD FLAG HW ACCESSIBLE is set and cleared in suspend and...

Capture-The-Flag

Capture-The-Flag...

WordPress: Information Disclosure - Unauthen Leak Private Content

A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hidesitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a...

EUVD-2026-85186

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456

The Reachy Mini robot's Bluetooth service contains a vulnerability where it fails to validate the specific caller of a Bluetooth command. The WriteValue function in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores the device identity passed by BlueZ , instead relying on ...

PT-2026-97279

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456: Concurrent Execution using Shared Resource with Improper Synchronization

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-80255

A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the sam...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dnsmasq (UTSA-2023-001151)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001151 advisory. An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. Tenable h...