CVE-2026-72222 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72217 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

CVE-2026-72217

The CVE-2026-72217 issue concerns SUNRPC in the Linux kernel where xdr_buf_to_bvec() writes a bio_vec before validating the destination slot, allowing an out-of-bounds write when budget is exhausted. The rq_bvec array used by nfsd_vfs_write() is allocated to rq_maxpages with no slack, so an overf...

PT-2026-72562

In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a delivery function that parses the incomi...

VulnCheck KEV: CVE-2021-2109

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP...

PT-2026-73054

siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...

PT-2026-72410

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc xprt across the asynchronous TLS handshake callback svc tcp handshake stores the raw svc xprt pointer in tls handshake args.ta data and submits the request through tls server hello x509. The handshake core takes...

SUSE CVE-2026-16241

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This...

CVE-2026-55157

creationtimestamp| type| source ---|---|--- 2026-08-14 22:35:05+00:00| published-proof-of-concept| https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-49mq-fc6q-3h46...

CVE-2026-48804

A flaw was found in python-socketio, a Python implementation of the Socket.IO realtime client and server. The server stores binary messages in memory while awaiting their attachments. A remote attacker can exploit this by sending a binary message and deliberately withholding some attachments. Thi...

CVE-2026-53708

creationtimestamp| type| source ---|---|--- 2026-08-14 20:35:03+00:00| published-proof-of-concept| https://github.com/IBM/mcp-context-forge/security/advisories/GHSA-9hgc-g3w5-67cm...

CVE-2026-73653 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse...

GO-2026-6179 vulnerabilities

Vulnerabilities for packages: containerd, nerdctl, snyk-cli, k3s, prometheus-mongodb-exporter, langfuse-fips, spire-server, kyverno, k3d, k8s-device-plugin, kots, reports-server, commercial-grafana, terraform, zot, aactl, langfuse...

GO-2026-6180 vulnerabilities

Vulnerabilities for packages: containerd, nerdctl, snyk-cli, k3s, prometheus-mongodb-exporter, langfuse-fips, spire-server, kyverno, k3d, k8s-device-plugin, kots, reports-server, commercial-grafana, terraform, zot, aactl, langfuse...

CVE-2026-56865 vulnerabilities

Vulnerabilities for packages: containerd, nerdctl, snyk-cli, k3s, prometheus-mongodb-exporter, langfuse-fips, spire-server, kyverno, k3d, k8s-device-plugin, kots, reports-server, commercial-grafana, terraform, zot, aactl, langfuse...

CVE-2026-56864 vulnerabilities

Vulnerabilities for packages: containerd, nerdctl, snyk-cli, k3s, prometheus-mongodb-exporter, langfuse-fips, spire-server, kyverno, k3d, k8s-device-plugin, kots, reports-server, commercial-grafana, terraform, zot, aactl, langfuse...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: nextcloud-server, keep-fips, pelias-api, unleash-fips, authentik-fips, homepage, semaphore, langfuse-fips, vitess, authentik, unleash, jitsucom-jitsu, librechat, arangodb, keep, cadence-web, langfuse...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: vitess, nextcloud-server, jitsucom-jitsu, langfuse...

CVE-2026-49457

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...