CVE-2026-68446

CVE-2026-68446 concerns the Linux kernel DRM VMware gfx driver (drm/vmwgfx), where the user-provided field vmw_surface_metadata::array_size is not validated against shader-model dependent limits. Multiple trusted sources (NVD, RH, Debian OSV/Debian CVE, Ubuntu, CIRCL, etc.) confirm the issue and ...

PT-2026-71102

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private NuGet metadata under specific conditions. Recommendations At the moment, there is ...

PT-2026-71314

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its...

Linux Distros Unpatched Vulnerability : CVE-2026-71261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drlibs drwav.h all versions through current master contains an integer overflow in W64 CUE chunk metadata parsing. In drwavmetadataprocesschunk, a stage-1...

Linux Distros Unpatched Vulnerability : CVE-2026-68384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS...

PT-2026-70960

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/vmwgfx component where the vmw surface metadata::array size field, which is provided by userspace, is not properly validated against specific limits based on t...

PT-2026-71103

Name of the Vulnerable Software and Affected Versions Puppet affected versions not specified Description An authenticated user can view private Puppet module metadata even if they do not have the required repository read access. Recommendations At the moment, there is no information about a newer...

CVE-2026-8667: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

CVE-2026-16033: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-70547: Missing Authorization

An authenticated user without repository read permission may access package metadata under specific conditions...

CVE-2026-19002: Buffer Copy without Checking Size of Input

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its...

CVE-2026-66380: Missing Authorization

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions...

CVE-2026-66379: Missing Authorization

An authenticated user may view private Puppet module metadata without repository read access...

CVE-2026-66378: Missing Authorization

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

CVE-2026-73290: Incorrect Authorization

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policyallowed path applies...

CVE-2026-69106: Improper Input Validation

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

CVE-2026-72790: Missing Authorization

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that...

PT-2026-71135

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions may be able to access package metadata under specific conditions. Recommendations At the moment, ther...

PT-2026-76563

Name of the Vulnerable Software and Affected Versions compliance-trestle versions prior to 4.0.4 Description An incomplete allowlist in the URLSecurityValidator within trestle/core/remote/security.py allows Server-Side Request Forgery SSRF via the HTTPSFetcher and SFTPFetcher remote-fetch paths...

PT-2026-71104

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions can access private OCI Open Container Initiative referrer metadata under specific conditions. OCI...