CVE-2026-64299

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions filterpredstring, filterpredstrloc and filterpredstrrelloc pass the field length to th...

EUVD-2026-49011

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions filterpredstring, filterpredstrloc and filterpredstrrelloc pass the field length to th...

CVE-2026-64299

CVE-2026-64299 (Linux kernel) fixes an out-of-bounds read in glob matching within tracing at xfs_lookup tracepoints by introducing a length-bounded glob_match_len() and using it in regex_match_glob(). String event fields may not be NUL-terminated, so previous length handling was inconsistent; the...

PT-2026-64520

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read occurs during glob matching in the tracing system. This happens because regex match glob calls glob match, which scans strings until a NUL byte is encountered,...

Linux Distros Unpatched Vulnerability : CVE-2026-64299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL- terminated, so the filter predicate functions filterpredstring...

Improper Neutralization

Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Improper Neutralization in the escape or escapeAll process when used with Zsh as the shell, especially if the Zsh options EXTENDEDGLOB or MAGICEQUALSUBST are enabled. An attacker can obtain...

GHSA-6V4M-FW66-8R4X Shescape: Path disclosure on Unix with Zsh

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST exacerbate the problem. In certain case, an attacker can leverage home directory...

Shescape: Path disclosure on Unix with Zsh

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST exacerbate the problem. In certain case, an attacker can leverage home directory...

EUVD-2026-48285

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash...

PT-2026-67587

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED GLOB and MAGIC EQUAL SUBST exacerbate the problem. In certain case, an attacker can leverage home directory...

DEBIAN-CVE-2026-14257

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

UBUNTU-CVE-2026-14257

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

CVE-2026-14257

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

PT-2026-63983

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 5.0.8 Description An issue exists that allows a denial of service via memory exhaustion. The expand function limits the number of results using a max option, but it does not restrict the length of each...

CVE-2026-14257: Uncontrolled Resource Consumption

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

vim security update

9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...

vim security update

9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...

TencentOS Server 2: perl-IO-Compress (TSSA-2026:0652)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0652 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...