CVE-2026-71219

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...

CVE-2026-80755 selinux: reject a permission value exceeding the class permission count

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

EUVD-2026-70349

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEGtable mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h - 7.04V -7.04V 05h - 7.26V -7.26V 06h - 7.49V...

CVE-2026-80745

CVE-2026-80745 affects the FP9931 regulator driver in the Linux kernel. The VPOSNEG_table[] voltage selector mapping contained two defects: a duplicate 7.04V entry that shifted all subsequent mappings by one position, and a missing 23 entries (only 41 of the required 64 were present), so any sele...

CVE-2026-80745 regulator: fp9931: Fix VPOS/VNEG voltage selector table

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEGtable mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h - 7.04V -7.04V 05h - 7.26V -7.26V 06h - 7.49V...

CVE-2026-80745 regulator: fp9931: Fix VPOS/VNEG voltage selector table

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEGtable mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h - 7.04V -7.04V 05h - 7.26V -7.26V 06h - 7.49V...

PT-2026-84943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the regulator for fp9931 where the VPOSNEG table mapping does not align with the hardware datasheet. The table contains an extra entry for the 7.04V mapping, which...

CVE-2026-80747: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

EUVD-2026-70240

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.toatom/1 before a...

SUSE CVE-2026-72358

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

CVE-2026-6469

A flaw was found in PostgreSQL where the ALTER TABLE ALTER TYPE command incorrectly reassigns ownership of dependent statistics objects to the current user. This grants the table owner unauthorized privileges to execute DROP STATISTICS and ALTER STATISTICS while locking out the legitimate owner...

PT-2026-84830

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.to atom/1 before...

CVE-2026-49249: Uncontrolled Resource Consumption

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.toatom/1 before a...

CVE-2026-80719

A flaw was found in the Linux kernel's Multi-Generational Least Recently Used MGLRU page table walker. When memory cgroup memcg reparenting occurs concurrently with page table walks, stale batch updates can lead to an underestimation of the number of pages. This can prevent the kernel from...

CVE-2026-75980

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980 BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-77856

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-74837

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

EUVD-2026-68929

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...