EUVD-2026-91327

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of...

Linux Distros Unpatched Vulnerability : CVE-2026-90052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc dm-integrity:...

CVE-2026-90052

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

CVE-2026-90052

CVE-2026-90052 is a buffer overflow in the Linux kernel's dm-integrity subsystem. Since commit 68c5c42567bc, integrity_metadata computes a checksum for every discarded block, but integrity_sector_checksum always writes the full digest regardless of the configured tag size. When the tag size is sm...

CVE-2026-90052 dm-integrity: fix buffer overflow with keyed discard

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

EUVD-2026-81913

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

CVE-2026-90052 dm-integrity: fix buffer overflow with keyed discard

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

CVE-2026-90052: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc "dm-integrity: replace forgeable discard filler with a keyed sector marker", integritymetadata computes a checksum for every discarded block into the...

rclone: FTP cross-session auth-proxy backend confusion

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

CVE-2026-86195

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

CVE-2026-86195 grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

CVE-2026-86195

grav-plugin-api versions 1.0.0 through 1.0.19 contain a privilege escalation vulnerability in the InvitationsController . The stripSuperFlags() method removes nested super flags but fails to strip dot-keyed equivalents such as api.super . A non-super user with api.access and api.users.write permi...

EUVD-2026-71997

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

PT-2026-86420

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...

CVE-2026-82745

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

CVE-2026-82745

ash (an Elixir data-layer framework) is vulnerable to improper access control in its ETS and Mnesia data layers. Unlike the SQL data layer, these layers implemented create as a keyed insert that silently replaces any existing entry sharing the same primary key, rather than enforcing uniqueness. A...

CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

EEF-CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Summary Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate...

EUVD-2026-67689

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...

Malicious code in keyed-mutex-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45a0cb60ef881a4f011fed410aacced4d83f39457bea6c4f21fa7d09076801 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...