CVE-2026-111166

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMFLoad loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex...

EUVD-2026-102293

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMFLoad loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex...

CVE-2026-98432

In the Linux kernel, the following vulnerability has been resolved: i...

CVE-2026-98432

ipv4: free inetopt and ireqopt after an RCU grace period...

CVE-2026-104875

The Ente cloud services platform is vulnerable to an authorization bypass in the POST /emergency-contacts/approve-recovery endpoint prior to server image 2026.07.09 . The root cause is an insufficiently scoped update pattern where the system authorized approval using a client-supplied userID and ...

cve-2026-52910-poc

CVE-2026-52910 — reuseport cBPF use-after-free reproducer A race reproducer and stress toolkit for CVE-2026-52910 , a use-after-free UAF in the Linux kernel's handling of classic BPF cBPF reuseport selector programs , fixed upstream by commit "bpf: Free reuseport cBPF prog after RCU grace period"...

CVE-2026-22009-Linux-eBPF-Map-Locking-Race-Use-After-Free

CVE-2026-22009 – Linux eBPF Map Locking Race → Use‑After‑Free Program Code C simulation // ebpfmapuaf.c - Simulated concurrent map update/free include include include include void mapdata = NULL; int mapfreed = 0; void updatemapvoid arg // Simulate eBPF program updating map if !mapfreed char...

Vulnerability-Disclosure-Policy

Vulnerability Disclosure Policy We believe that vulnerability disclosure is a two-way street. Vendors, as well as researchers, must participate in co-ordinated vulnerability disclosure. When Enable Security discovers vulnerabilities through its own research, it will notify vendors of these...

CVE-2026-76277: Improper Input Validation

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edituser capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the...

Linux Distros Unpatched Vulnerability : CVE-2026-98320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer t...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: Route lookups now perform under a RCU read-side lock. Our current route lookups mctproutelookup and mctproutelookupnull traverse the network’s route list without holding the RCU read lock. This means that the route lookups...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a UAF Use-after-Allocation issue by correcting mismatching between the bpfprog/attachment and tasks-trace-RCU flavors. Uprobes always use bpfprogrunarrayuprobe under tasks-trace-RCU protection. However, it is possible ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables – Release flowtable after the rcu grace period with an error. The function synchronizercu is called after unregistering the hooks from the error path. This is because a hook that already references this...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftct: Fixed a use-after-free in the destroy function for timeout objects. The nftcttimeoutobjDestroy function frees the timeout object using kfree, immediately after nfcttimeoutout, without waiting for an RCU grace...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fixed an issue where PCM OSS buffer allocation might overflow. We have received reports of situations where INTMAX overflow occurs during memory allocation using vmalloc, specifically in the function sndpcmplugalloc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netsched: schsfq: rejecting invalid perturb periods. Gerrard Tai reported that the perturbperiod of SFQ does not have a range check yet, and this could be exploited to trigger a race condition, which has been fixed in a separa...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Unconditionally increments set-nelems before inserting an element. In the event that the set is full, a new element is inserted and then removed without waiting for the RCU grace period. Meanwhile, the RCU...

Astra Linux – Vulnerability in golang-github-golang-jwt-jwt

golang-jwt is a Go implementation of JSON Web Tokens. Starting from version 3.2.0 and before versions 5.2.2 and 4.5.2, the parse.ParseUnverified function splits its argument which is untrusted data using periods. As a result, in the case of a malicious request where the Authorization header...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: The reuseport cBPF prog is freed after the RCU grace period. Eulgyu Kim reported the issue below with a reproduction example. The reproduction example sets up a UDP reuseport group with a cBPF prog and replaces it with a new...

SUSE CVE-2026-93288

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...