PT-2026-72419

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the batadv send tt request function incorrectly handles send buffer allocation failures. The function allocates a tt req node to prevent...

PT-2026-72636

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the octeontx2-pf driver during teardown. The send-queue timestamp ring is allocated using the qmem alloc function when timestamping is enabled, but the otx2 free ...

PT-2026-72837

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Distributed Lock Manager DLM where message handles in the node-send queue may not be ordered by the oldest sequence number during high-request benchmark scenarios...

CVE-2026-73571

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

CVE-2026-73571

CVE-2026-73571 is an authorization bypass in Zimbra Collaboration (ZCS) before 10.1.17 , caused by improper validation in the delegated email-sending functionality. An authenticated attacker can send specially crafted SOAP requests to the SaveDraftRequest handler to impersonate another user and s...

CVE-2026-73571

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

CVE-2026-73571

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

CVE-2026-73571

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

CVE-2026-72766

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-72766

n8n contains a type confusion in the Send Email node that can read arbitrary local files and trigger SSRF. Affected versions: n8n before 1.123.67, n8n 2.x before 2.31.5, and n8n 2.32.x before 2.32.1. The issue arises when non‑string values are fed into the node’s text or HTML body and interpreted...

CVE-2026-72766

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-72766 n8n before 1.123.67 Arbitrary File Read via Send Email Node

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-72766 n8n before 1.123.67 Arbitrary File Read via Send Email Node

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

EUVD-2026-56145

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-72766 n8n before 1.123.67 Arbitrary File Read via Send Email Node

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-11894 Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

CVE-2026-72766: Access of Resource Using Incompatible Type

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

CVE-2026-68366

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

CVE-2026-68425

CVE-2026-68425 concerns the Linux kernel InfiniBand MAD path (IB/mad). The vulnerability arises when kernel-handled RMPP receive processing begins reassembly for DATA responses before matching the response to an outstanding send, enabling a reordered burst to reach receive-side insertion without ...