Linux Distros Unpatched Vulnerability : CVE-2026-80716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after...

CVE-2026-75118: Stack-based Buffer Overflow

A pre-authentication stack-based buffer overflow vulnerability exists in the httpgdprdecrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface c...

CVE-2026-81532: Stack-based Buffer Overflow

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message,...

CVE-2026-75126: Stack-based Buffer Overflow

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation:...

CVE-2026-73209: Uncontrolled Recursion

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

PT-2026-86703

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num encaps underflow on bridge VLAN untag The DEV PATH BR VLAN UNTAG case post-decrements info-num encaps inside WARN ON ONCE. num encaps is u8, so if it's already 0 the decrement still happens and wra...

PT-2026-86704

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXL HEADERLOG SIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXL RAS CAPABILITY LENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18. CXL...

PT-2026-83137

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safe strcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATH MAX. safe strcpy is strncpy, whic...

PT-2026-83279

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web login first post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web sys enablePasswd post...

CVE-2026-80662: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXLRASCAPABILITYLENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18...

CVE-2026-81533: Stack-based Buffer Overflow

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-82343: Buffer Copy without Checking Size of Input

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack...

UBUNTU-CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...

CVE-2026-67560: Stack-based Buffer Overflow

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedomete...

CVE-2026-40013

An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of...

UBUNTU-CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-58106: Out-of-bounds Write

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy with a bounded safestrcpy helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy is strncpy, which...

CVE-2026-77218: Stack-based Buffer Overflow

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The webloginfirstpost handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the websysenablePasswdpost handle...

PT-2026-83278

PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web radiusSrv post family of handlers copies the radKey, radKey 0, radDftParamKey, radName, and radIp POST parameters into...