CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

CVE-2026-80789

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

EUVD-2026-71263

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80789 nvmet-tcp: bound SGL data length before allocating command buffers

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

EUVD-2026-71432

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmettcpmapdata reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inlinedatasize before use...

CVE-2026-80789

In the Linux kernel nvmet-tcp component (NVMe/TCP target), a host-controlled 32-bit sgl->length field is only validated for in-capsule SGL descriptors. Non-inline transport SGL data-block descriptors—those used for out-of-capsule writes—skip the check entirely, causing an unbounded sgl_alloc()...

CVE-2026-85786: Improper Handling of Highly Compressed Data (Data Amplification)

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...

CVE-2026-80788: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

Linux Distros Unpatched Vulnerability : CVE-2026-85024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error...

CVE-2026-17255: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of the prefix length in ICMPv6 Router Advertisements...

The vulnerability of the `tap_get_user_xdp()` function in the `drivers/net/tap.c` file of the Linux kernel’s network device driver allows a attacker to cause a service failure.

The vulnerability of the tapgetuserxdp function in the drivers/net/tap.c file of the Linux kernel’s network device driver module is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the `ras_core_isEnabled()` function in the `drivers/gpu/drm/amd/ras/rascore/ras_core.c` file of the Direct Rendering Infrastructure (DRI) driver for AMD graphics cards in Linux operating systems allows a malicious actor to cause a service failure.

The vulnerability of the rascoreisEnabled function in the drivers/gpu/drm/amd/ras/rascore/rascore.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability could allow a remote...

The vulnerability of the netvsc_copy_to_send_buf() function in the drivers/net/hyperv.netvsc.c driver for Linux kernel-based network devices allows a attacker to cause a service failure.

The vulnerability of the netvsccopytosendbuf function in the drivers/net/hyperv.netvsc.c file of the Linux kernel network device driver is related to errors during pointer scaling. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the cleanup_prefix_route() function in the net/ipv6/addrconf.c module of the IPv6 protocol implementation in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the cleanupprefixroute function in the net/ipv6/addrconf.c module of the IPv6 protocol implementation in the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

PT-2026-85629

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmet tcp map data because the length passed into the allocator is controlled by the remote...

PT-2026-86161

Name of the Vulnerable Software and Affected Versions undici versions 6.7.0 through 6.28.0 undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The WebSocket client crashes the Node.js process during the opening handshake if a server responds with a subprotocol th...

CVE-2026-77465

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0 , the Peggy 5.1.0-generated recursive-descent parser in lib/parser.js has functions (peg$parsevalue, peg$parsearray, peg$parseinline_table_entry) that recurse through nested arrays and inline tables without a depth limit . A r...

CVE-2026-85100

A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It...

CVE-2026-84886

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may ...