CVE-2026-74672 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

EUVD-2026-64358

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

CVE-2026-68755

A bundle writer may create misleading release promotion information under specific conditions...

CVE-2026-68755 Bundle writers may alter trusted release information in JFrog Artifactory

A bundle writer may create misleading release promotion information under specific conditions...

CVE-2026-68755

This CVE concerns Artifactory where a bundle writer may alter or create misleading release promotion information under certain conditions. The connected records identify Artifactory’s bundle writer as the affected component, with the underlying issue described as producing misleading release info...

EUVD-2026-57245

A bundle writer may create misleading release promotion information under specific conditions...

PT-2026-71110

A bundle writer may create misleading release promotion information under specific conditions...

CVE-2026-48169

CVE-2026-48169 (PraisonAI Platform) has concrete cross-workspace IDOR and privilege-escalation flaws. The API routes enforce workspace membership but the service layer (in IssueService and ProjectService) performs global primary-key lookups (e.g., get/update/delete) without filtering by workspace...

CVE-2026-48086

OpenReception’s appointment-booking software (pre‑1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...

SUSE CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-13117

A flaw was found in OpenVPN. An incomplete guard allows remote authenticated peers to trigger a use-after-free vulnerability during TLS Transport Layer Security session promotion. This can lead to a denial of service, making the service unavailable, or memory leakage, which could potentially expo...

ALPINE-CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

EUVD-2026-51239

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-12996

CVE-2026-12996 affects OpenVPN 2.6.0–2.6.20 and 2.7_alpha1–2.7.4, via a use-after-free in ack_write_buf triggered by specific control/auth sequence during TLS session promotion/expiry, potentially causing a crash or memory leak (denial of service). Connected advisories note that updates exist to ...

CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-12996

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

EUVD-2026-51234

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

CVE-2026-13117

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...