CVE-2026-89045

A flaw was found in zstd-jni. This vulnerability allows an attacker to trigger an infinite loop by providing negative length parameters to the ZstdInputStreamNoFinalizer.read method. This can cause the read method to spin indefinitely, holding the stream monitor and blocking other threads from...

PT-2026-90053

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

PT-2026-90278

In the Linux kernel, the following vulnerability has been resolved: ip6 gre: fix hardware header length for NBMA tunnels ip6gre tnl link config route accumulates the lower device's hardware header length into dev-hard header len whenever header ops is set. This is incorrect for both users of head...

PT-2026-90249

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read chunk range svc rdma read chunk range walks a Read chunk's segment list to build a sub-range starting at byte offset and spanning length bytes for a Position-Zero or Call chunk. Two arithmet...

CVE-2026-54135: Uncontrolled Resource Consumption

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

Linux Distros Unpatched Vulnerability : CVE-2026-88054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks bu...

PT-2026-90436

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifs sb verify signature bounds the on-disk ubifs sig node-len field before handing the signature payload to verify pkcs7 signature, but the check has the wrong sign: if le...

PT-2026-90459

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm sendrecv msg locked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy...

PT-2026-90304

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In ghes handle arm hw error, after skipping the cper sec proc arm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeofe...

PT-2026-90063

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

PT-2026-90211

In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm migrate request handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node ...

PT-2026-90137

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb write read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block wri...

PT-2026-90266

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth gss: enforce krb5 token minimum length svcauth gss unwrap priv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gss unwrap: if len xdr stream remainingxdr goto unwrap...

CVE-2026-89586: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by...

PT-2026-90061

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1 f19 i2c master transfer is the master xfer for the DS28E17 1-Wire to I2C bridge. On an I2C M RECV LEN read, it takes the length from the device. The downstream slave...

PT-2026-90103

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6fire comm receiver handler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

Linux Distros Unpatched Vulnerability : CVE-2026-88045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector

A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service DoS condition, either by consumi...

rclone: S3 multipart declared-length memory exhaustion

Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...