149450 matches found
CVE-2026-98765
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...
EUVD-2026-103850
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...
CVE-2026-98698
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload filsencryptassocreq accepts a ReAssociation Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt is called with an emp...
CVE-2026-98527
In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and zynqgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...
CVE-2026-111988
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
CVE-2026-98452 smb: client: clean up failed cached directory opens
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...
CVE-2026-98449
The Linux kernel contains a vulnerability in the SMB client where compound requests fail to properly manage mids during a reconnect. Specifically, compound_send_recv() unlocks the server without removing mids from the pending_mid_q after a send failure. During reconnection, cifs_abort_connection(...
CVE-2026-98449 smb: client: delete compound mids on send failure before unlock
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst kicks off a reconnect. compoundsendrecv still has those mids on pendingmidq, but it unlocks the server without...
CVE-2026-111988 dyad-sh dyad OAuth Callback cross-site request forgery
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
CVE-2026-111988 dyad-sh dyad OAuth Callback cross-site request forgery
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
EUVD-2026-103669
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
CVE-2026-111988 dyad-sh dyad OAuth Callback cross-site request forgery
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
CVE-2026-111988
A security flaw exists in dyad-sh dyad versions up to 1.16.0 within the OAuth Callback Handler component. This vulnerability allows for a remote cross-site request forgery (CSRF) attack through specific manipulations. To remediate this issue, users should upgrade to version 1.17.0-beta.1 (patch 3...
CVE-2026-111988
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1...
PT-2026-116898
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013 write event config already ignores repeated enable requests, but a repeated disable...
PT-2026-116746
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A runtime Power Management PM leak exists in the zynq gpio driver. The pm runtime get sync function increments the usage counter even upon failure, and the zynq gpio request function...
CVE-2026-105964: Allocation of Resources Without Limits or Throttling
The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...
PT-2026-116715
In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt work after releasing the WDT IRQ airoha npu remove calls cancel work sync on each core's wdt work, but the watchdog IRQ that queues it is requested with devm request irq and is freed only after .remov...
PT-2026-117066
In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devm request irq enables the interrupt before it returns, so the handler may run while probe is still initializing the device. Initialize the MMIO address and spinlock...
CVE-2026-98698: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload filsencryptassocreq accepts a ReAssociation Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt is called with an emp...