CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

EUVD-2026-64586

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649

CVE-2026-74649 affects the Linux kernel staging driver rtl8723bs . The WEP shared-key authentication handler in OnAuthClient() copies the challenge-text element into a fixed 128-byte chg_txt buffer using an attacker-controlled length (up to 255 bytes) without validation. A malicious AP can send a...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

EUVD-2026-64332

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: zero shared page before exposing to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO, so the page contains stale kernel data from...

PT-2026-79602

In the Linux kernel, the following vulnerability has been resolved: ip6 tunnel: clear skb2-cb in ip6ip6 err ip6ip6 err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6 send. The clone still carries the outer packet's inet6 skb parm...

PT-2026-79621

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb shared info tailroom xdpf clone clones broadcast copies into a single page and sets frame sz to PAGE SIZE. xdp build skb from frame later treats that page like a normal XDP frame and expects th...

PT-2026-79654

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg txt...

EUVD-2026-64016

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/sessionid/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with ed...

CVE-2026-62674

Omnigent (open-source AI agent framework) prior to 0.3.0 is vulnerable to an authenticated Remote Code Execution via the PUT /sessions/{session_id}/agent endpoint. The endpoint validates LEVEL_EDIT permission for the session but fails to reject a bound shared or template agent whose agent.session...

CVE-2026-74451

A flaw was found in the drm/panthor component of the Linux kernel. The ifacefwtocpuaddr function, responsible for validating firmware interface structure sizes, does not adequately check if the firmware-provided Microcontroller Unit MCU virtual address fits entirely within the shared memory...

EUVD-2026-63534

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743 Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

CVE-2026-15743

Catalyst::Plugin::Static::Simple (Perl) versions through 0.38 always set the Cache-Control header to "public" in its _serve_static method, with no mechanism to override this behavior. This instructs proxies that responses may be stored in a shared cache and reused for other users' requests, inclu...

JetBrains YouTrack < 2025.3.156085 / 2026.1.x < 2026.1.13913 / 2026.2.x < 2026.2.18112 Authentication Bypass (CVE-2026-75045)

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.156085, 2026.1.x prior to 2026.1.13913, or 2026.2.x prior to 2026.2.18112. It is, therefore, affected by an authentication bypass vulnerability: - An unauthenticated attacker could download database backups via shar...

CVE-2026-62727

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Telephony Service allows an authorized attacker to elevate privileges locally...

CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-19506

A race condition in the check.jst file of RDK-B WebUI (firmware version rdkb-2025q4-kirkstone.04.10.26) allows a remote attacker to gain unauthorized access by sending concurrent authentication requests that exploit shared authentication state. No patch or workaround is documented; the issue was ...

CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

DEBIAN-CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...