CVE-2026-89644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

PT-2026-96414

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsi alloc sgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dma map sg attrs+0x217/0x310 dma map sg attrs+0x217/0x310 dma map sg attrs+0x4a/0x7...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107266)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107266 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when handling missing device in readonechunk Store the error...

CVE-2026-89644: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

PT-2026-90360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An extent map leak occurs during NOCOW direct I/O write operations. The function btrfs dio iomap begin invokes btrfs get extent, which generates an extent map reference that must be...

rclone: FTP cross-session auth-proxy backend confusion

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

EUVD-2026-75577

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

WordPress Posts map plugin <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Posts map versions = 0.1.3...

CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

EUVD-2026-75393

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

CVE-2026-78082

SP Property is a Joomla extension by joomshaper.com vulnerable to unauthenticated SQL injection in versions prior to 4.1.4 . The root cause lies in the property search and listing query builders, which assembled WHERE and ORDER BY clauses (for zipcode, sorting, price_range_dropdown, and psize_ran...

CVE-2026-78082 Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

CVE-2026-78082: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

CVE-2026-88017: Exposure of Data Element to Wrong Session

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

PT-2026-89689

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

sigcorr

SigCorr Passive Cross-Protocol Attack Detection for Mobile Core Networks SigCorr is the first open-source tool to detect cross-protocol attack chains spanning SS7/MAP, Diameter S6a, and GTPv2-C through unified subscriber identity correlation. Features Cross-protocol correlation — Links SS7/MAP,...

kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...