CVE-2026-98138

A flaw was found in the Linux kernel's NTFS file system driver. When synchronizing the file system, the driver unconditionally clears the volume's dirty state flag even if errors were previously encountered. A local user capable of triggering a file system synchronization on a volume with recorde...

CVE-2026-98137

A flaw was found in the Linux kernel's NTFS file system driver. This issue can lead to information disclosure when allocating storage space for files. Due to an improper error check, failures during disk zeroing operations are silently ignored rather than aborting the allocation. A local user cou...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

GNOME libsoup buffer error vulnerability

GNOME libsoup has a buffer overflow vulnerability. This vulnerability stems from libsoup’s failure to properly limit the total size of WebSocket messages when reassembling them into GByteArray objects. A remote attacker can send specially crafted fragments, leading to size truncation and ultimate...

Malware in chaikit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-93287

A flaw was found in the Linux kernel's I2C System Management Bus SMBus subsystem. A local user can trigger an out-of-bounds memory read by submitting a transfer request with an oversized or invalid block length. This occurs because the kernel does not properly validate user-supplied transfer...

CVE-2026-98136

A flaw was found in the Linux kernel's NTFS file system driver. When reading the attribute definition table, the driver does not properly verify that each entry fits within the allocated memory buffer. A local attacker could exploit this vulnerability by mounting a specially crafted NTFS storage...

CVE-2026-98133

A flaw was found in the Linux kernel's NTFS file system implementation. When an error occurs while setting an extended attribute EA, the kernel prematurely clears the flag indicating that extended attributes are present. A local user can exploit this vulnerability by triggering a failed extended...

CVE-2026-98135

A flaw was found in the Linux kernel's NTFS file system driver. A local user capable of mounting storage volumes could cause a Denial of Service DoS and crash the operating system by mounting a specially crafted NTFS file system image. Due to missing input validation of the cluster configuration ...

CVE-2026-101075 Netcore NR289-GE Location Time location_time.cgi system os command injection

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /locationtime.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is...

CVE-2026-98130

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. A race condition exists when starting an SCTP timer, where the timer can expire before it is reset, resulting in improper reference counting for the connection association. An attacker could exploit this...

CVE-2026-93283

A flaw was found in the Linux kernel's I3C Improved Inter-Integrated Circuit master subsystem. This issue can result in a Denial of Service DoS caused by a system crash. When device registration fails, the driver frees the device object but fails to clear internal pointers referencing the freed...

CVE-2026-93817

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

CVE-2026-93814

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI subsystem. When a system suspend is initiated while an SPI controller operating in target mode has an active data transfer, the ongoing transfer is not cleanly aborted. This issue allows a local user to cause a Denial of Servi...

CVE-2026-93281

A flaw was found in the Linux kernel's Realtek Wi-Fi driver rtw89. This vulnerability may allow an attacker within wireless range to cause a Denial of Service DoS via a system crash. By transmitting a crafted wireless frame with malformed capability information, an attacker can trigger an imprope...

MSC-2026-12292

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12265

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive user system data –...

MSC-2026-12212

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive user system data –...

kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB

A flaw was found in the Linux kernel's AMD GPU Graphics Processing Unit driver, specifically within the drm/amdgpu/vcn4 component. This vulnerability allows for an out-of-bounds read when processing an Instruction Buffer IB. An attacker could potentially exploit this to read sensitive information...