Linux Distros Unpatched Vulnerability : CVE-2026-64409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork Every once in a while we see a hung btmtksdioflush task: INFO: task kworker/u17:0:189 blocked for...

Linux Distros Unpatched Vulnerability : CVE-2026-50251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of...

PT-2026-64695

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vfio mig get next state function where the loop used to skip unsupported optional states does not account for the VFIO DEVICE STATE ERROR sentinel. When a blocked...

PT-2026-64511

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd fault fops read function where a failure in copy to user within an inner list for each entry loop only breaks the inner loop. This causes the outer while...

libp2p: yamux connection DoS via oversized data frame

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

Improper Validation of Specified Quantity in Input

Overview libp2p is a libp2p: The Python implementation of the libp2p networking stack Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input through the handleincoming process. An attacker can cause the read loop to block indefinitely by sending a...

GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

GO-2026-5490 Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy

Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy...

EUVD-2026-42621

Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config...

GHSA-FFPJ-XV5C-P3GW Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config

Summary Two regexes in backend/openwebui/utils/middleware.py that parse skill-mention tags backtrack in On² on input that contains . Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one suc...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

kernel: drm/xe/dma-buf: fix UAF with retry loop

A flaw was found in the Linux kernel, specifically within the drm/xe/dma-buf component. This Use-After-Free UAF vulnerability occurs due to an issue in a retry loop, where a buffer object is prematurely freed on error. An attacker could potentially exploit this to cause memory corruption, leading...

EUVD-2026-48638

In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irqdata.rdev not being assigned Commit 64a6b577490c "regulator: tps65219: Remove debugging helper function" removed the tps65219getrdevbyname helper along with the irqdata.rdev assignment that depended on...

CVE-2026-64218

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait f...

EUVD-2026-48626

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait f...

K000162380: XPath vulnerability CVE-2026-32287

Security Advisory Description Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-level selectors such as "1=1" or "true". CVE-2026-32287 Impact A local, unauthenticated attacker can exploit the...

EUVD-2026-41123

ImageMagick: Infinite Loop in connected-components when providing invalid arguments...

ImageMagick: Infinite Loop in connected-components when providing invalid arguments

When providing invalid arguments to the connected-components option an infinite loop will occur...

GHSA-QHMF-7FC4-8Q3H ImageMagick: Infinite Loop in connected-components when providing invalid arguments

When providing invalid arguments to the connected-components option an infinite loop will occur...

CVE-2026-55731 Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...