CVE-2026-72110

The CVE-2026-72110 entry documents a Linux kernel issue in which a nascent task may bail out of copy_process() to free_task() before p->bpf_storage is initialized, causing the nascent task’s bpf_storage pointer to be a stale copy from the parent. This can lead to kernel hangs or use-after-free...

CVE-2026-72110 bpf,fork: wipe ->bpf_storage before bailouts that access it

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpfstorage before bailouts that access it Currently, copyprocess can bail out to freetask before p-bpfstorage has been initialized, with this call graph shown here for the !CONFIGMEMCG case: copyprocess...

CVE-2026-72110 bpf,fork: wipe ->bpf_storage before bailouts that access it

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe -bpfstorage before bailouts that access it Currently, copyprocess can bail out to freetask before p-bpfstorage has been initialized, with this call graph shown here for the !CONFIGMEMCG case: copyprocess...

Libvirt: information disclosure via world-readable storage volume images during clone/convert

...

PT-2026-72741

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

PT-2026-73024

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btree writepages holds fs info-zoned meta io lock across the whole writeback loop,...

SUSE CVE-2026-63299

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before...

CVE-2026-49989

CrateDB prior to 6.2.8 and 6.3.2 exposes an authorization bypass in the HTTP blob API. The HTTP path (GET/PUT/DELETE /_blobs/{table}/{digest}) authenticates requests but does not enforce privileges via AccessControl, unlike the SQL path. As a result, any authenticated user who knows a blob’s SHA-...

GO-2022-0411 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner...

GO-2026-4517 vulnerabilities

Vulnerabilities for packages: azurefile-csi, azurefile-csi-fips...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: delve, stakater-reloader, cert-exporter, guac, crossplane-provider-aws-sns, authservice, crossplane-provider-aws-cloudformation, db-operator, octo-sts, sealed-secrets, terraform-provider-acme, argo-rollouts, crossplane-provider-azure-managedidentity, azcopy,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: gitsign, crossplane-provider-azure-managedidentity, kubeflow, gobuster, dynamic-localpv-provisioner, dgraph, fq, kube-state-metrics, crossplane-provider-aws, kubeflow-katib, src, dockerize, eksctl, actions-runner-controller, kaf, cosign,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: guac, nvidia-container-toolkit, opencost, terraform-provider-acme, crossplane-provider-azure-managedidentity, dgraph, crossplane-provider-keycloak, migrate, cluster-api, eksctl, datadog-operator, crossplane-provider-azure-authorization, sftpgo-plugin-eventstore,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: guac, crossplane-provider-aws-sns, crossplane-provider-aws-cloudformation, sealed-secrets, terraform-provider-acme, flux-notification-controller, crossplane-provider-azure-managedidentity, neuvector-sigstore-interface, snyk-cli, falco-no-driver, osv-scanner, src,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: stakater-reloader, guac, nvidia-container-toolkit, crossplane-provider-azure-managedidentity, dgraph, rancher-fleet, nri-memcached, dockerize, helm-docs, eksctl, kustomize, nuclei, crossplane-provider-azure-authorization, gomplate, opentelemetry-collector-contrib,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: gitsign, guac, src-fingerprint, vexctl, glab, crossplane-provider-azure, ksops, flux-notification-controller, crossplane-provider-azure-managedidentity, goreleaser, neuvector-sigstore-interface, flux-kustomize-controller, snyk-cli, sigstore-scaffolding,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: stakater-reloader, guac, crossplane-provider-azure-managedidentity, dgraph, nri-memcached, dockerize, eksctl, kustomize, nuclei, crossplane-provider-azure-authorization, gomplate, opentelemetry-collector-contrib, xcaddy, rabbitmq-cluster-operator, nodetaint, sonobuoy...

SUSE CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

CVE-2026-72857

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-19483

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...