PT-2026-94826

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description When CONFIG CFI CLANG is enabled, the prog-bpf func already skips the kcfi instruction during setup. Including this instruction again in the tailcall jump offset causes the system to jum...

WS-2026-0128

RediSearch: the default KNN score field name is built in a stack variable-length array sized from the vector field name, so an FT.SEARCH KNN query on a vector field with a very long name exhausts the stack and crashes the Redis server DoS. Fixed in 2.6.38, 2.8.39, 2.10.33, 8.2.16, 8.4.13 and 8.10...

PT-2026-94915

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack overflow exists in the ljca enumerate gpio function. The function reads the bank num variable from a device and uses it to control a loop that writes data into the valid pin arra...

CVE-2026-92518: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

CVE-2026-93164: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Move optimized uprobe from nop5 to nop10 Andrii reported an issue with optimized uprobes 1 that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data...

PT-2026-95187

Name of the Vulnerable Software and Affected Versions go-openapi/swag jsonutils versions prior to 0.27.1 Description A stack overflow issue exists in ordered JSON parsing and serialization caused by unbounded recursion without a depth limit. Remote unauthenticated attackers can exploit this by...

CVE-2026-90416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-93435: Uncontrolled Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3800)

According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow...

CVE-2026-93372: Stack-based Buffer Overflow

Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-93119: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: ljca: bound banknum in ljcaenumerategpio ljcaenumerategpio reads desc-banknum from the device and loops validpini = getunalignedle32... for i banknum. validpin holds only LJCAMAXGPIONUM / 32 = 2 entries. Two checks run befor...

CVE-2026-81480: Stack-based Buffer Overflow

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-90358: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90358: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

PT-2026-94417

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto acomp component where ACOMP REQUEST ON STACK reserves insufficient storage for asynchronous fallbacks. When an async implementation is selected, the acomp...

CVE-2026-90416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

PT-2026-94648

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the bpf get task stack function fails to initialize the buf buffer on all return paths. This affects the bpf get task stack and bpf get task sta...

PT-2026-94418

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The st33zp24 status function fails to verify the result of the transport read operation. In scenarios where the I2C transport skips i2c master recv due to a short or failed register-sele...

CVE-2026-93061: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3825)

According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow...