CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74725

A use-after-free vulnerability exists in the Linux kernel enic driver during device removal. The function enic_remove() cancels the reset and change_mtu_work items but fails to cancel tx_hang_reset. A TX timeout firing while the device is being removed can schedule enic_tx_hang_reset() to execute...

CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal

In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...

CVE-2026-74606

CVE-2026-74606 is a use-after-free vulnerability in the Linux kernel's eventfs component, specifically in eventfs_remove_rec(). When this function recursively removes a child entry, it subsequently reads list.next from that child via list_for_each_entry(). If free_ei() drops the final reference a...

CVE-2026-74606 eventfs: Fix use-after-free in eventfs_remove_rec()

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfsremoverec eventfsremoverec recursively removes the child at the current loop position. After the recursive call returns, listforeachentry advances by reading list.next from the removed child...

CVE-2026-74606 eventfs: Fix use-after-free in eventfs_remove_rec()

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfsremoverec eventfsremoverec recursively removes the child at the current loop position. After the recursive call returns, listforeachentry advances by reading list.next from the removed child...

PT-2026-79730

In the Linux kernel, the following vulnerability has been resolved: enic: fix tx hang reset use-after-free on device removal enic remove cancels the reset and change mtu work items but does not cancel tx hang reset. A TX timeout that fires while the device is being removed can schedule enic tx ha...

Linux Distros Unpatched Vulnerability : CVE-2026-74725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that...

PT-2026-79611

In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix use-after-free in eventfs remove rec eventfs remove rec recursively removes the child at the current loop position. After the recursive call returns, list for each entry advances by reading list.next from the removed...

Linux Distros Unpatched Vulnerability : CVE-2026-74606

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - eventfs: Fix use-after-free in eventfsremoverec eventfsremoverec recursively removes the child at the current loop position. After the recursive call returns,...

Linux Distros Unpatched Vulnerability : CVE-2026-74588

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap- acked chunk onto another transport's transmitted list without...

CVE-2026-54134

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

CVE-2026-54134

OctoPrint (web interface for 3D printers) versions prior to 1.11.8 and 2.0.0rc3 are vulnerable to file exfiltration via parser differentials between its custom Tornado upload handler and Flask/Werkzeug. An attacker with FILE_UPLOAD permission can inject reserved internal form fields through query...

Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-87 / ESA-2026-88)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-87 and ESA-2026-88 advisories. - A lower privileged user who holds only the privilege to read agent policies can...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102023)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102023 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device...

CVE-2026-49217 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

RUSTSEC-2026-0266 `internment` 0.8.7 was removed from crates.io due to a malicious dependency

A new version of the internment crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 90 minutes later. The compromised version was used as part of...

`tinymember` was removed from crates.io due to affiliation with malicious code

While tinymember did not directly contain malicious code, it was owned by the same user as arone and aronenao, which contained suspicious build scripts. This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads. There were no crates depending on this crate on crates.io. T...

WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability

Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...

CVE-2026-54740

In Lemmy versions prior to 0.19.19 and 1.0.0-alpha.18, the federated ActivityPub handler CollectionRemove::receive in crates/apub/activities/src/community/collection_remove.rs omits the rank check (is_higher_mod_or_admin_check) enforced by the local API, allowing any signed ActivityPub Remove act...