CVE-2026-68259

CVE-2026-68259 affects the Linux kernel's DRM/amdkfd path, specifically allocate_event_notification_slot. The vulnerability arises from not validating the upper bound of user-supplied event IDs used by CRIU; valid IDs are 0 to KFD_SIGNAL_EVENT_LIMIT. The fix adds bounds checks, ensuring the upper...

EUVD-2026-55294

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

PT-2026-69659

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdkfd component where the allocate event notification slot function fails to perform bounds checking on the event id specified for allocation. This...

PT-2026-69987

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 7.10.14 Rocket.Chat versions prior to 8.0.8 Rocket.Chat versions prior to 8.1.7 Rocket.Chat versions prior to 8.2.7 Rocket.Chat versions prior to 8.3.7 Rocket.Chat versions prior to 8.4.5 Rocket.Chat versions prio...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: cerbos, kubescape-server-fips, amazon-ssm-agent-fips, grype-fips, pulumi-language-yaml, snyk-cli, syft, skaffold, kyverno-fips, kubescape, google-osconfig-agent, src-fingerprint-fips, kyverno, argo-cd, kaniko, cloudbeat, nuclio-controller-fips, gitlab-runner,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: cerbos, kubescape-server-fips, amazon-ssm-agent-fips, grype-fips, pulumi-language-yaml, snyk-cli, syft, skaffold, kyverno-fips, kubescape, google-osconfig-agent, src-fingerprint-fips, kyverno, argo-cd, kaniko, cloudbeat, nuclio-controller-fips, gitlab-runner,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: cerbos, kubescape-server-fips, amazon-ssm-agent-fips, grype-fips, pulumi-language-yaml, snyk-cli, syft, skaffold, kyverno-fips, kubescape, google-osconfig-agent, src-fingerprint-fips, kyverno, argo-cd, kaniko, cloudbeat, nuclio-controller-fips, gitlab-runner,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: cerbos, kubescape-server-fips, amazon-ssm-agent-fips, grype-fips, pulumi-language-yaml, snyk-cli, syft, skaffold, kyverno-fips, kubescape, google-osconfig-agent, src-fingerprint-fips, kyverno, argo-cd, kaniko, cloudbeat, nuclio-controller-fips, gitlab-runner,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: argo-events, pulumi-language-yaml, nfpm, pulumi-language-dotnet, xeol, flux-image-automation-controller, nuclei, tfsec, kaniko, syft, kyverno, k9s, witness, steampipe, grype, pulumi-language-java, gitaly, gitsign, goreleaser, rancher-fleet, gptscript, argo-workflows,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: argo-events, pulumi-language-yaml, nfpm, pulumi-language-dotnet, xeol, flux-image-automation-controller, nuclei, tfsec, kaniko, syft, kyverno, k9s, witness, steampipe, grype, pulumi-language-java, gitaly, gitsign, goreleaser, rancher-fleet, gptscript, argo-workflows,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: argo-events, pulumi-language-yaml, nfpm, pulumi-language-dotnet, xeol, flux-image-automation-controller, nuclei, tfsec, kaniko, syft, kyverno, k9s, witness, steampipe, grype, pulumi-language-java, gitaly, gitsign, goreleaser, rancher-fleet, gptscript, argo-workflows,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: argo-events, pulumi-language-yaml, nfpm, pulumi-language-dotnet, xeol, flux-image-automation-controller, nuclei, tfsec, kaniko, syft, kyverno, k9s, witness, steampipe, grype, pulumi-language-java, gitaly, gitsign, goreleaser, rancher-fleet, gptscript, argo-workflows,...

CVE-2026-66000

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47361

The Datadog Android application (prior to v541-5.9.2 ) is vulnerable because BubbleChatActivity is exported without a permission guard. It accepts a SEND intent with a caller-supplied conversation_id . When the activity closes and no in-process session matches that ID, it unconditionally cancels ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...