CVE-2025-33147: Use of a Broken or Risky Cryptographic Algorithm

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication...

CVE-2026-81181: Session Fixation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

PT-2026-95581

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68 Description The password authentication flow for protected shared notes fails to rotate the session identifier after successful authentication, leading to session fixation. This occurs when an attacker obtai...

CVE-2026-93748: Use of Cache Containing Sensitive Information

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

PT-2026-95588

Name of the Vulnerable Software and Affected Versions http-cache-semantics versions prior to 4.2.1 Description The software fails to properly validate security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request a URL using a large max-stale...

Autodesk Shared Components < 1.12.0 / 2.x < 2.2.0 DoS (adsk-sa-2026-0015)

The version of Autodesk Shared Components installed on the remote Windows host is prior to 1.12.0, or 2.x prior to 2.2.0. It is, therefore, affected by an uncontrolled recursion vulnerability. A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontroll...

Linux Distros Unpatched Vulnerability : CVE-2026-90191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notificatio...

CVE-2026-52727

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-52727

lxc-ci , the continuous integration and image-build scripts for LXC , shipped Arch Linux images (built from images/archlinux.yaml) that retained a shared pacman local-signing private key in /etc/pacman.d/gnupg. Every container or VM created from those images inherited the same key. An attacker wh...

AZL-103017 CVE-2026-90186 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

DEBIAN-CVE-2026-90191

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

SUSE CVE-2026-89993

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

EUVD-2026-81784

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90191 mailbox: riscv-sbi-mpxy: validate RPMI notification lengths

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

CVE-2026-90186

CVE-2026-90186 affects the Linux kernel null_blk driver. When the module is loaded with shared_tags enabled, a per-device resize of submit_queues or poll_queues via configfs calls blk_mq_update_nr_hw_queues() on the shared tag set, shrinking hardware queue contexts. The resulting NULL hardware co...

EUVD-2026-81779

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

CVE-2026-90186 null_blk: reject per-device queue resize for shared tag set

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

GHSA-X5QG-8PQ6-39H6 Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references. Original Description vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-75516 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...