CVE-2026-20820

CVE-2026-20820 is a local privilege-escalation vulnerability caused by a heap-based buffer overflow in the Windows Common Log File System Driver. An authenticated, locally-adjacent attacker could trigger the overflow to obtain higher privileges on the host. The CVE is corroborated by multiple fee...

CVE-2026-20818

Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally...

CVE-2026-20818

CVE-2026-20818 is a Windows Kernel information-disclosure vulnerability caused by insertion of sensitive data into a log file, allowing a local attacker to disclose information. The CTI indicates this is a locally exploitable issue with a MEDIUM base score (CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I...

AZL-74348 CVE-2025-68778 affecting package kernel for versions less than 6.6.121.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current...

CVE-2025-68778

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current...

UBUNTU-CVE-2025-68778

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current...

CVE-2025-68778

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current...

CVE-2026-0408

NETGEAR WiFi range extenders are affected by CVE-2026-0408 due to a path traversal vulnerability that allows an attacker with LAN authentication to access the router’s IP and read the dynamically generated webproc file, which contains the username and password submitted to the router GUI. Affecte...

Windows Kernel Information Disclosure Vulnerability

Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally...

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

CVE-2025-68804 platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosecishtp: Fix UAF after unbinding driver After unbinding the driver, another kthread crosecconsolelogwork is still accessing the device, resulting an UAF and crash. The driver doesn't unregister the EC device ...

CVE-2025-68778 btrfs: don't log conflicting inode if it's a dir moved in the current transaction

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current...

CVE-2025-68778

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current...

CVE-2025-68778

CVE-2025-68778 corresponds to a Linux kernel Btrfs logging/transaction bug where logging an inode location while moving a directory in the same transaction could cause an inconsistent log replay, potentially leading to a hard-link count issue and a failed mount. The provided advisories confirm th...

CVE-2025-68778 btrfs: don't log conflicting inode if it's a dir moved in the current transaction

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't log conflicting inode if it's a dir moved in the current transaction We can't log a conflicting inode if it's a directory and it was moved from one parent directory to another parent directory in the current...

CVE-2025-68771

Summary of CVE-2025-68771 (Linux kernel, ocfs2): A kernel BUG in ocfs2_find_victim_chain() was triggered when cl_next_free_rec in the allocation chain list was 0, which caused a BUG_ON(!cl->cl_next_free_rec) panic. The fix adds a guard in ocfs2_claim_suballoc_bits() to handle two conditions be...

CVE-2025-68771 ocfs2: fix kernel BUG in ocfs2_find_victim_chain

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2findvictimchain syzbot reported a kernel BUG in ocfs2findvictimchain because the clnextfreerec field of the allocation chain list next free slot in the chain list is 0, triggring the...

Astra Linux – Vulnerability in Ruby-Rack

Rack provides an interface for developing web applications in Ruby. Before versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger could be exploited by crafting input containing newline characters to manipulate log entries. The provided proof-of-concept demonstrates injecting malicious content...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences such as newline characters into the header, resulting in log injection. This vulnerability has been...

SUSE-SU-2026:20077-1 Security update for python-uv

This update for python-uv fixes the following issues: - CVE-2025-62518: astral-tokio-tar: Fixed boundary parsing issue allowing attackers to smuggle additional archive entries bsc1252399 - CVE-2025-58160: tracing-subscriber: Fixed log pollution bsc1249011...