CVE-2026-64500

A flaw was found in the Linux kernel's lpc32xxadc driver. A local attacker could trigger a race condition during the driver's initialization by causing a spurious interrupt. This improper handling of interrupts before completion initialization can lead to a kernel panic, resulting in a Denial of...

NIP-04 parsing amplifies malformed ciphertext memory use

The NIP-04 decryption parser split attacker-controlled content on every ?iv= separator and collected all resulting segments before checking that the message had the expected two parts. It also Base64-decoded the complete IV text before checking that it represented the required 16-byte AES-CBC IV....

SUSE CVE-2026-9739

Vulnerable to DNS rebinding attacks when using SSE http://b/499408790. During the beta phase, we implemented allowed-origins and allowed-hosts flags to align with MCP security guidelines. However, the hardcoded Access-Control-Allow-Origin: header in the SSE initialization handler was inadvertentl...

PT-2026-66771

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 1.0 through 9.16 pgAdmin 4 versions 5.0 through 9.16 Description An issue exists where schema, table, publication, and subscription names sourced from pg catalog via the browser tree are not properly escaped. Because...

The vulnerability of the __cdns3_gadget_init() function in the drivers/usb/cdns3/cdns3-gadget.c driver for Linux device drivers allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the cdns3gadgetinit function in the drivers/usb/cdns3/cdns3-gadget.c driver for Linux USB device drivers is related to an incorrect definition of internal states. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-64447

A flaw was found in the Linux kernel's ipu7 media driver. This vulnerability involves incorrect memory management where memory can be freed multiple times and subsequently accessed after it has been freed, specifically during error handling paths in device initialization. A local attacker could...

EUVD-2026-51028

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-64510

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI Non-Volatile Memory NVM Firmware Interface Table NFIT core. Improper error handling during the initialization process can leave a dangling pointer. A local attacker could potentially trigger an ACPI Machine Che...

kernel: nvmet-tcp: fix race between ICReq handling and queue teardown

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. A race condition exists between the handling of an Initialization Connection Request ICReq and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a...

CVE-2026-64307

A flaw was found in the Linux kernel's crypto:ccp module. A local attacker with access to a userspace process could exploit this vulnerability. If Secure Encrypted Virtualization SEV initialization fails while Kernel-based Virtual Machine KVM is running virtual machines, the attacker can trigger ...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30697)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from the improper handling of initialization, transform contexts, and per-instance state by...

The vulnerability of the mlxbf_pmc_init_perftype_counter() function in the drivers/platform/mellanox/mlxbf-pmc.c kernel module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mlxbfpmcinitperftypecounter function in the drivers/platform/mellanox/mlxbf-pmc.c module of the Linux kernel is related to incorrect initialization of resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-64308

A flaw was found in the Linux kernel's crypto: ccp module, which handles AMD Secure Encrypted Virtualization SEV and Secure Nested Paging SNP features. A local user, by sending specific commands through the /dev/sev interface, could exploit improper initialization handling. If SEV initialization...

CVE-2026-64420

A flaw was found in the Linux kernel's crosec driver. This vulnerability, a use-after-free, occurs when the device's data pointer is set too early during initialization. If the initialization process fails, the memory for the crosecdev structure is released, but other kernel components, such as t...

kernel: nvmet-tcp: fix race between ICReq handling and queue teardown

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. A race condition exists between the handling of an Initialization Connection Request ICReq and the teardown of a queue. A remote attacker, by sending an ICReq and immediately closing the connection, could trigger a...

CVE-2026-58182

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

UBUNTU-CVE-2026-58182

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whi...

CVE-2026-58182

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whi...

CVE-2026-58182

The issue CVE-2026-58182 affects Apache Traffic Server via the ts_lua plugin, which mishandles initialization, transform context, and per-instance state. Affects ATS versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The available fix is to upgrade to ATS 9.2.15 or 10.1.4, which address the v...

CVE-2026-58182

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...