CVE-2026-80763

CVE-2026-80763 is an out-of-bounds read in the Linux kernel Bluetooth HCI subsystem. In hci_cc_le_set_cig_params(), the handler trusts the num_handles field of the LE Set CIG Parameters Command Complete response and reads the trailing handle array without verifying that the remaining skb data act...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CLSA-2026-1788270629 Fix CVE(s): CVE-2026-14669

SECURITY UPDATE: Heap buffer overflow in tochartimestamptz. DCHtochar copied the timezone abbreviation into a workspace budgeted at DCHMAXITEMSIZ bytes per format character with an unchecked strcpy, and any client can select a longer POSIX abbreviation via SET TIME ZONE CVSS 8.8, arbitrary code...

Malicious code in chai-set (npm)

Source: amazon-inspector 28dfa5b2cccd6b50e33c5fbb98357210b6eeac23c9764183693b3eb74da40f44 The package chai-set was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cf-middleware-set-header (npm)

--- Credit: OpenSSF source...

PT-2026-85604

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the Command Complete dispatch only validates the fixed portion of the LE Set CIG Parameters response. The function hci cc le set cig para...

PT-2026-91791

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport header when sending VLAN-tagged frame In packet parse headers, when processing a VLAN-tagged frame, skb set network header is called to advance network header past the VLAN tag to the inner protoc...

PT-2026-85622

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the HID core. The hid set field function passes field-usage + offset to hid dump input before verifying if the offset is within the allowed bounds of...

PT-2026-86152

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The cache interceptor fails to handle the Set-Cookie response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheab...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

PT-2026-86267

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...

PT-2026-91300

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hid set field hid set field hands field-usage + offset to hid dump input before the guard that bounds offset: hid dump inputfield-report-device, field-usage + offset, value; if offset =...

PT-2026-91360

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci cc le set cig params...

CVE-2026-80763: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

Linux Distros Unpatched Vulnerability : CVE-2026-84933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In...

PT-2026-91367

In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4 xattr block set retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-84185

CVE-2026-84185 affects the jwcrypto library, a Python implementation of the JOSE (JSON Object Signing and Encryption) standards. The flaw occurs during verification of a General JSON Serialization JWS against a key set (JWKset): due to a coding error, the library fails to correctly match the key ...

kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...