CVE-2026-72122

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

CVE-2026-72122

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

UBUNTU-CVE-2026-72122

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

CVE-2026-72122 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

EUVD-2026-58880

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

CVE-2026-72122 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext

...

PT-2026-72311

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RX SETUP failure bcm sendmsg reads bo-ifindex and checks bo-bound before taking lock sock, while bcm notify, bcm connect and bcm release all mutate both fields under that same...

CVE-2026-50029

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029 js-toml has silent type confusion via falsy-primitive duplicate-key bypass

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

CVE-2026-50029 js-toml has silent type confusion via falsy-primitive duplicate-key bypass

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...

DEBIAN-CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

EUVD-2026-58670

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific...

CVE-2026-73645

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal mint operation could fail silently. The wrap and onTransferReceiv...

CVE-2026-73645

OpenZeppelin Confidential Contracts ERC7984 wrapper contains a defect prior to 0.3.1 where an overflowing internal _mint on the ERC7984ERC20Wrapper could silently fail. The wrap and onTransferReceived paths did not handle this failure, allowing a user to transfer the underlying token without rece...

CVE-2026-73645 OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal mint operation could fail silently. The wrap and onTransferReceiv...

CVE-2026-73645 OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal mint operation could fail silently. The wrap and onTransferReceiv...

CVE-2026-29036

A flaw was found in cJSON, a JSON parser and generator. This vulnerability allows unauthenticated attackers to manipulate JSON Patch operations by supplying crafted JSON Pointer escape sequences. This can lead to silent corruption of data or the deletion of unintended keys, potentially bypassing...

Linux Distros Unpatched Vulnerability : CVE-2026-68330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write...