CVE-2026-89617

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...

EUVD-2026-76527

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89615 fs/ntfs3: bound page_lcns[] index by the log record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89615

CVE-2026-89615 is a buffer overflow in the Linux kernel's NTFS3 filesystem driver. In the copy_lcns loop and the redo shorten loop, page_lcns[] is indexed at j + i, where i runs up to the log record's lcns_follow. That count is validated only against the record's own length, not the target entry'...

CVE-2026-89615 fs/ntfs3: bound page_lcns[] index by the log record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

EUVD-2026-76350

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89444

CVE-2026-89444 affects the Linux kernel's platform/x86: dell-wmi-sysman driver. The set_attribute() function populates the security area of the BIOS attribute request buffer with the current admin password via populate_security_buffer(), then calls print_hex_dump_bytes() to dump the entire reques...

CVE-2026-89444 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-89444 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-76920

A flaw was found in Wireshark. This vulnerability, located in the 3gpp phone log file parser, could allow a local attacker to trigger a crash by enticing a user to open a specially crafted log file. This could lead to a Denial of Service DoS. Mitigation To mitigate this issue, users should avoid...

CVE-2026-89248 AVideo WebRTC Plugin Information Disclosure via status.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

CVE-2026-89249 AVideo YPTWallet Stored XSS via CryptoWallet Configuration

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in walletlog.information. Administrators viewing pending...

Improper Output Neutralization for Logs

Overview org.webjars.npm:morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the escapeLogField function. An attacker can manipulate log entries by injecting unescaped double quotes into HTTP heade...

Improper Output Neutralization for Logs

Overview morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the escapeLogField function. An attacker can manipulate log entries by injecting unescaped double quotes into HTTP headers such as...

CVE-2026-87859

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...

DEBIAN-CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...