CVE-2026-90775

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

EUVD-2026-76988

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

CVE-2026-90767 Froxlor before 2.3.12 SSH Key Injection via authorized_keys

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add endpoint, allowing customers to inject arbitrary lines into authorizedkeys files. Attackers can inject malicious SSH key entries with option directives to gain persistent unauthorized access that...

SUSE CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

Linux Distros Unpatched Vulnerability : CVE-2026-89716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits valu...

Linux Distros Unpatched Vulnerability : CVE-2026-89666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtim...

CVE-2026-89438

A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology ISST component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core power feature. A local attacker could exploit this by providing...

Shopper: Negative discount values accepted and propagated through order calculation pipeline

Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...

GHSA-5VF4-452P-JJHF Shopper: Negative discount values accepted and propagated through order calculation pipeline

Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the discount process. An attacker can manipulate financial calculations and produce unintended order totals by submitting negative values through the administrative interface, which are then persisted and...

CVE-2026-89450

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager VMM can exploit this vulnerability by providing a virtual Stream ID vSID that exceeds the intended 20-bit width of the SIDMATCH field. This improper input validation causes the system to incorrectly...

CVE-2026-89716

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

DEBIAN-CVE-2026-89716

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

CVE-2026-89666

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

DEBIAN-CVE-2026-89613

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

CVE-2026-89613

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...

AZL-100674 CVE-2026-89438 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89701

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

UBUNTU-CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...