selinux: reject a permission value exceeding the class permission count

...

EUVD-2026-70767

There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0...

The vulnerability of the `tap_get_user_xdp()` function in the `drivers/net/tap.c` file of the Linux kernel’s network device driver allows a attacker to cause a service failure.

The vulnerability of the tapgetuserxdp function in the drivers/net/tap.c file of the Linux kernel’s network device driver module is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the osdmap_decode() function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, allows a hacker to gain access to protected information or cause service failures.

The vulnerability of the osdmapdecode function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, is related to incorrect input of configuration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected...

PT-2026-85471

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...

CVE-2026-84469: Improper Input Validation

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

PT-2026-85440

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-85528: Improper Input Validation

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...

CVE-2026-50553: Improper Input Validation

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

The vulnerability of the mshv_vtl_ioctl_add_vtl0_mem() function in the drivers/hv/mshv_vtl_main.c driver for the Microsoft HyperV guest mode operating system on Linux allows a attacker to compromise the accessibility of protected information.

The vulnerability of the mshvvtlioctladdvtl0mem function in the drivers/hv/mshvvtlmain.c driver of the Microsoft HyperV guest mode operating system on Linux is related to incorrect validation of input data. Exploiting this vulnerability could allow an attacker to compromise the accessibility of...

CVE-2026-84504: Improper Input Validation

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center, related to insufficient validation of input data, allows attackers to enhance their privileges and gain unauthorized access to protected information.

The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center are related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and gain unauthorized access to protected information...

PT-2026-85525

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash fileupload process' function, which iterates through an entire array and validates only the first file. This...

The vulnerability of the kvm_vcpu_init_nested() function in the arch/arm64/kvm/nested.c module of the virtualization subsystem on the 64-bit ARM-based Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the kvmvcpuinitnested function in the arch/arm64/kvm/nested.c module of the virtualization subsystem on the 64-bit ARM-based Linux operating system is related to the copying of buffers without checking input data. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the wbt_init_enable_default() function in the block/blk-wbt.c module, which supports the block-level kernel in the Linux operating system, allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the wbtinitenabledefault function in the block/blk-wbt.c module, which supports the block-level kernel in the Linux operating system, is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to...

CVE-2026-84947: Improper Input Validation

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

ROS-20260904-73-0018

The vulnerability of the checkunsafeoptions function in the GitPython library for interacting with Git repositories is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

The vulnerability of the vti6_tnl_lookup() function in the net/ipv6/ip6_vti.c module of the IPv6 protocol implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vti6tnllookup function in the net/ipv6/ip6vti.c module of the IPv6 protocol implementation in the Linux operating system is related to incorrect checking of the unsafe equivalence of input data. Exploiting this vulnerability may allow an attacker, acting remotely, to...

The vulnerability of the ccp_aes_complete() function in the drivers/crypto/ccp/ccp-crypto-aes.c module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ccpaescomplete function in the drivers/crypto/ccp/ccp-crypto-aes.c module of the Linux kernel is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the cc1352_bootloader_rx() function in the drivers/greybus/gb-beagleplay.c module of the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the cc1352bootloaderrx function in the drivers/greybus/gb-beagleplay.c module of the Linux operating system is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...