1600 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-74624
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid...
CVE-2026-74568
A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for ARM64 systems, specifically within the virtual Generic Interrupt Controller VGIC. A race condition can occur when a Logical Processor Interrupt LPI is released and then re-registered with the same identifier by a guest...
MLflow < 3.15.0 SSRF (CVE-2026-64849)
The version of MLflow installed on the remote host is prior to 3.15.0. It is, therefore, affected by a server-side request forgery vulnerability: - The unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl only for the original URL while the webhook delivery...
EUVD-2026-62870
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causin...
CVE-2026-17097
IBM PowerVM Hypervisor is affected by an improper validation of array index (CWE-129) in the hypervisor call interface . An attacker with root access to a guest partition can issue a specially crafted hypervisor call that causes a virtual processor to become permanently unresponsive , requiring a...
CVE-2026-62671
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer...
CVE-2026-74337
A flaw was found in the Linux kernel, specifically within the BPF Berkeley Packet Filter subsystem. This vulnerability allows NMI Non-Maskable Interrupt and tracepoint BPF programs to re-enter certain internal locks, known as LRU Least Recently Used locks, while they are already held. This re-ent...
CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...
CVE-2026-9693 Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...
BIT-NODE-MIN-2026-56848
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
BIT-NODE-2026-56848
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
Security Bulletin: This Power System update is being released to address CVE-2026-17097
Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL ...
AZL-96096 CVE-2026-74523 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: qede: sync udptunnel ports outside qedelock in the recovery path A TX timeout on a qede NIC that has VXLAN/GENEVE tunnel ports configured wedges the rtnetlink control plane of the whole machine: NETDEV WATCHDOG: ens6f1 qede:...
UBUNTU-CVE-2026-74337
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpflrupopfree/pushfree already hold on the same CPU, AA-deadlocking. Lockdep reports...
CVE-2026-72112
In the Linux kernel, the following vulnerability has been resolved: iouring/bpf-ops: reject re-registration of an already-bound ops ioinstallbpf only rejects a second registration on the ctx side ctx-bpfops and sets the per-map back-pointer ops-priv unconditionally. The structops link path never...
CVE-2026-74337
CVE-2026-74337 describes a Linux kernel vulnerability where NMI/tracepoint BPF programs could re-enter per-CPU or global LRU locks held by bpf_lru_pop_free()/push_free(), causing AA-deadlock. The fix converts LRU lock sites to rqspinlock_t and adds a recovery path for failure windows to avoid nod...
Linux Distros Unpatched Vulnerability : CVE-2026-74337
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpflrupopfree/pushfree...
K000162917: Node.JS vulnerability CVE-2026-56848
Security Advisory Description A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x. CVE-2026-56848 Impact There is no impact; F...