889870 matches found
CVE-2026-74590 fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpfgetfsveritydigest dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of...
DEBIAN-CVE-2026-74584
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: zero shared page before exposing to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO, so the page contains stale kernel data from...
CVE-2026-74584
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: zero shared page before exposing to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO, so the page contains stale kernel data from...
CVE-2026-76597
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...
DEBIAN-CVE-2026-68767
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
DEBIAN-CVE-2026-68768
hashcat contains a heap-based buffer overflow out-of-bounds write in the outfilewrite function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZLARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that...
CVE-2026-68766
hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code...
CVE-2026-68768
hashcat contains a heap-based buffer overflow out-of-bounds write in the outfilewrite function in src/outfile.c. When assembling output into a fixed-size buffer HCBUFSIZLARGE, 16 MB, the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that...
CVE-2026-68767
hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE...
DEBIAN-CVE-2026-63310
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
CVE-2026-63312
NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...
CVE-2026-65915
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...
DEBIAN-CVE-2026-63312
NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...
CVE-2026-63310
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
DEBIAN-CVE-2026-65915
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...
CVE-2026-62383
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...
DEBIAN-CVE-2026-62383
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...
CVE-2026-74584
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: zero shared page before exposing to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO, so the page contains stale kernel data from...
CVE-2026-74584 RDMA/bnxt_re: zero shared page before exposing to userspace
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: zero shared page before exposing to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO, so the page contains stale kernel data from...
EUVD-2026-64332
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: zero shared page before exposing to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO, so the page contains stale kernel data from...