CVE-2026-72465 xprtrdma: Sanitize the reply credit grant after parsing

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...

CVE-2026-72464 xprtrdma: Repost Receive buffers for malformed replies

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

CVE-2026-72465

The CVE-2026-72465 issue affects the Linux kernel’s xprtrdma handling. The vulnerability arises when a well-formed reply carrying an inflated credit grant bypasses the credit clamp due to an early exit, allowing the reply to drive receive postings past re_max_requests. The fix moves the credit-cl...

CVE-2026-72217 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

PT-2026-72652

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma wc receive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdma reply handler. The handler must post a...

PT-2026-72505

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc clnt across the TLS connect worker The TLS connect path has a use-after-free: nothing pins the upper rpc clnt across the delayed connect worker. xs connect stores task-tk client in sock xprt::clnt as a raw...

Linux Distros Unpatched Vulnerability : CVE-2026-72473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake i...

PT-2026-72661

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl kref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdma req could return to its fr...

PT-2026-72883

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

Linux Distros Unpatched Vulnerability : CVE-2026-72464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a...

CVE-2026-57472

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-57471

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

EUVD-2026-58678

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-57472

CVE-2026-57472 affects the KUNBUS RevPiPyLoad 0.11.0 XML-RPC management interface. A CWE-22 path traversal in the file management functionality enables a local unauthenticated attacker to delete arbitrary files with the RevPiPyLoad daemon privileges, leading to loss of configuration integrity and...

CVE-2026-57472 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-57471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57471

CVE-2026-57471 affects KUNBUS RevPiPyLoad 0.11.0 via the XML-RPC management interface. A path traversal flaw in the file management component allows a local unauthenticated attacker to read arbitrary files with the RevPiPyLoad daemon’s privileges by sending crafted requests to the local managemen...

EUVD-2026-58677

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-19826

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

CVE-2026-19826 alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...