GO-2026-6171 WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A...

CVE-2026-72206

A flaw was found in the Linux kernel's NTFS filesystem driver. Insufficient validation of index block headers within INDX blocks could allow a local attacker to craft a malicious NTFS filesystem image. When this image is processed by the kernel, it could lead to a kernel panic due to an...

CVE-2026-72191

A flaw was found in the Linux kernel's ntfs3 driver. A local attacker can exploit this vulnerability by mounting a specially crafted NTFS filesystem image. This can lead to an integer underflow during a memory copy operation, resulting in an out-of-bounds kernel write. Successful exploitation...

CVE-2026-72162

A flaw was found in ocfs2, a component of the Linux kernel. On-disk corruption of an inode's embedded extent list can lead to an array-index-out-of-bounds error. This occurs when the lnextfreerec value is zero or exceeds lcount during a write operation to the affected file. A local attacker with...

GO-2026-6155 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule...

CVE-2026-72150

A flaw was found in the Linux kernel's sunrpc component. The xprtcreateargs structure is allocated on the stack without initialization in rpcsysfsxprtswitchaddxprtstore. This can lead to critical fields containing uninitialized stack garbage. Exploiting this vulnerability can result in a kernel...

Linux Distros Unpatched Vulnerability : CVE-2026-72280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCREL2 It is entirely possible for a guest to...

Linux Distros Unpatched Vulnerability : CVE-2026-72455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1...

Linux Distros Unpatched Vulnerability : CVE-2026-74411

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup wa...

Linux Distros Unpatched Vulnerability : CVE-2026-72163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the...

Linux Distros Unpatched Vulnerability : CVE-2026-72322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Fre...

Linux Distros Unpatched Vulnerability : CVE-2026-68463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with...

Linux Distros Unpatched Vulnerability : CVE-2026-72034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the moun...

PT-2026-80410

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq trusts the unsigned 32-bit length in every PostgreSQL backend frame and subtracts four without first checking that the wire length is at least four. A backend frame whose...

PT-2026-80416

During WebDAV Infinite Scale TUS upload creation, a transport failure can return a nil HTTP response along with an error. When handling the failure, rclone dereferences the nil response before checking the error, causing a panic that can crash the process in unrecovered contexts such as VFS mount...

CVE-2026-73502: NULL Pointer Dereference

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

CVE-2026-52738: Uncaught Exception

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalizedstate/zebradb/transparent.rs, the finalized-state writer originally appli...

PT-2026-80358

Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi...

PT-2026-80397

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule...

PT-2026-80361

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input: - Unchecked /Size, /Index,...