PT-2026-64606

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt may return a replayable error and free its response buffer. If the SMB2 ioctl init function fails before the...

PT-2026-64615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec function calls set info sec without performing a per-handle access check. This allows a client t...

Linux Distros Unpatched Vulnerability : CVE-2026-64383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is...

Linux Distros Unpatched Vulnerability : CVE-2026-64450

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks on...

Linux Distros Unpatched Vulnerability : CVE-2026-64384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails...

PT-2026-64601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client regarding the parsing of POSIX SID lengths. The function posix info sid size reads sid1 to determine the subauthority count, but the boundary check...

PT-2026-64604

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. The SMB2 flush function maintains response buffer bookkeeping across replay attempts. If a replayable flush response is received and the...

PT-2026-64618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the smb2 query dir function stores a pointer to stack-allocated private data within the ksmbd file readdir data. When concurrent QUERY DIRECTORY requests use the sam...

Linux Distros Unpatched Vulnerability : CVE-2026-64382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails...

PT-2026-64609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Ownership and group modifications were ignored when mounting with SMB3 POSIX Extensions, unless CIFS MOUNT CIFS ACL or CIFS MOUNT MODE FROM SID were explicitly set. The issue occurs with...

PT-2026-64605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt may return a replayable error and free its response buffer. If the SMB2 notify init function fails before the...

PT-2026-64478

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB2 client where the smb2 calc size function clears data length during overlap handling. This behavior can cause an invalid response to be incorrectly identified ...

Linux Distros Unpatched Vulnerability : CVE-2026-64437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL Commit f580d27e8928 ksmbd: fix use-after-free of a deferred filelock on double...

PT-2026-64671

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE MSG can carry a Gap ACK blocks record in its data area. tipc get gap ack blks only verifies that the record's len field is self-consistent with i...

Linux Distros Unpatched Vulnerability : CVE-2026-64388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions...

Linux Distros Unpatched Vulnerability : CVE-2026-64379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mod...

GO-2026-5525 GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp

GoBGP has a panic in AdjRib.Update via malformed BGP Update message Nil Pointer Dereference in github.com/osrg/gobgp...

GHSA-73X5-H92W-XC2J Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...

GHSA-X2FF-V5V8-M75M Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

CVE-2026-66027

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...