CVE-2026-72365

A flaw was found in the netfs component of the Linux kernel. This vulnerability arises from incorrect handling of NETFSRREQOFFLOADCOLLECTION during writethrough operations. This issue could lead to asynchronous OSYNC writes not being properly collected, potentially resulting in data inconsistency...

CVE-2026-72355

A flaw was found in the Linux kernel's netfs component. This vulnerability arises from incorrect barriering when processing the subrequest list, allowing a subrequest to be observed before it has been fully added by the application thread. This race condition could lead to unexpected system...

CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-74367

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

EUVD-2026-58499

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

CVE-2026-72842

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

CVE-2026-72842

The CVE-2026-72842 entry concerns luci-app-lxc on OpenWrt. It describes an ACL inconsistency that lets low-privileged, authenticated LuCI users access backend container management routes without proper authorization checks. A path traversal via /.%2E in the lxc_name parameter can escape container...

CVE-2026-18622

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

EUVD-2026-57737

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

PT-2026-71905

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxc name parameter to escape container directories...

K000162865: NLnet Labs Unbound vulnerability CVE-2026-44608

Security Advisory Description NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers it could result in heap use-after-free and...

CVE-2026-18709

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709 Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

EUVD-2026-56883

An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock...

CVE-2026-18709

CVE-2026-18709 concerns MongoDB Server: an authenticated user with direct network access to a shard can improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination. The underlying root cause is described as inadequate authorization around the pr...

EUVD-2026-56914

An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an...