Off-by-one Error

org.apache.tomcat, tomcat-catalina is vulnerable to an Off-by-one Error. The vulnerability is due to rewrite processing restarting at the second rule instead of the first, which allows an attacker to potentially bypass intended rewrite rules or cause unintended request processing...

opensource_defect_repare_cc

需求 漏洞挖掘与修复 项目中在code目录下的代码仓有已知的若干漏洞，你需要重写该项目的核心模块（接口完全不变，实现方式变化，重构前后相似度不超过20%，所有public/private方法签名，异常声明，注解，泛型，类继承关系必须和原项目一致，并且重构前后功能保持一致，通过测试所有已知的接口行为和输入输出一致性，验证前后功能的一致性），并修复代码仓中的全部已知bug，修复前后性能劣化不超过5%，中work/docs放置README.md，内容为AI重构流程说明（如何分解模块，验证正确性，修复bug，降低重复率），用于评委主观评审。...

CVE-2026-100618: Authorization Bypass Through User-Controlled Key

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

CVE-2026-98048

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...

DEBIAN-CVE-2026-98048

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...

AZL-104691 CVE-2026-97559 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

DEBIAN-CVE-2026-97559

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-97559

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

AZL-104523 CVE-2026-97555 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

UBUNTU-CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

UBUNTU-CVE-2026-97559

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-98048

The Linux kernel contains a vulnerability within the bpf subsystem where the mark_fastcall_pattern_for_call() function fails to ensure that "spill; call; fill" instruction series are not interrupted by a jump. This flaw causes the rewrite applied by bpf_remove_fastcall_spills_fills() to be unsoun...

CVE-2026-98048 bpf: don't rewrite bpf_fastcall patterns entered by a jump

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...

EUVD-2026-86701

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...

CVE-2026-97559

The Linux kernel contains a vulnerability in the SMB client where the functions replace_sids_and_copy_aces() and set_chmod_dacl() incorrectly use a u16 accumulator to track DACL size. This causes an integer wraparound when the rewritten DACL exceeds 64K (specifically reaching a wraparound with 86...

EUVD-2026-86867

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-97559 smb: client: fail DACL rewrite when the new DACL exceeds 64K

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-97559 smb: client: fail DACL rewrite when the new DACL exceeds 64K

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-97559

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...