15142 matches found
CVE-2026-80954: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...
PT-2026-90217
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ring-buffer component. The ring buffer subbuf order set function can clear cpu buffer-free page without proper synchronization. To prevent races with ring...
PT-2026-90408
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the nfsd component where the nfsd break one deleg function sets the NFSD4 CALLBACK RUNNING bit to serialize recall work before calling nfsd4 run cb to queue the recall. If...
PT-2026-90084
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the i3c component where the function i3c device get supported xfer mode dereferences dev-desc to obtain the master controller without holding the bus-lock. This...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107295)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107295 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4xattrsetentry creates new EA inodes while...
CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts
A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...
CVE-2026-88770
Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...
CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts
A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...
CVE-2026-88770
A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...
CVE-2026-87825
A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary's shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after...
kernel: security/keys: fix missed RCU read section on lookup
A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...
kernel: sctp: fix race between sctp_wait_for_connect and peeloff
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...
kernel: security/keys: fix missed RCU read section on lookup
A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...
CVE-2026-77770: Missing Authorization
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...
EUVD-2026-75094
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive wwmutex acquire in amdgpudevcoredumpformat When dumping IB contents from a hung job, amdgpudevcoredumpformat acquired the VM root PD's reservation via amdgpuvmlockbypasid and then, for each IB, called...
CVE-2026-87825 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causi...
CVE-2026-49313
Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49313
Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...
CVE-2026-49313
CVE-2026-49313 is a permission control vulnerability in the app lock module of a Huawei device (CNA: [email protected]). Successful exploitation may affect service confidentiality . The CVSS 3.1 score is 5.5 (Medium) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N , indicating a local attack ...