CVE-2025-15381: Exposure of Sensitive Information to an Unauthorized Actor

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

The vulnerability of the __doTraceBtrfs__inode() function in the include/trace/events/btrfs.h module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the doTraceBtrfs inode function in the include/trace/events/btrfs.h module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the rb_reset_cpu() function in the kernel/trace/ring_buffer.c module, which supports Linux kernel tracing, allows an attacker to access protected information or cause a service failure.

The vulnerability of the rbresetcpu function in the kernel/trace/ringbuffer.c module, which supports Linux kernel tracing, is related to an infinite loop. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

GO-2026-4826 NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server

NATS: Message tracing can be redirected to arbitrary subject in github.com/nats-io/nats-server...

EUVD-2026-16505

dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution...

CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow

...

The vulnerability of the `register_synth_event()` function in the kernel/trace/trace_events_synth.c module, which supports Linux kernel tracing, allows a malicious actor to access protected information or cause system failures.

The vulnerability of the registersynthevent function in the kernel/trace/traceeventssynth.c module, which supports kernel tracing in Linux operating systems, relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to access...

The vulnerability of the eprobetrigger_func() function in the kernel/trace/trace_eprobe.c module, which supports Linux operating system tracing, allows a hacker to cause a service failure.

The vulnerability of the eprobetriggerfunc function in the kernel/trace/traceeprobe.c module, which supports kernel tracing in Linux operating systems, is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerabilities of the functions test_gen_synth_cmd() and test_empty_synth_event() in the kernel/trace/synth_event_gen_test.c module, which support Linux operating system tracing, allow a malicious actor to cause a service failure.

The vulnerabilities of the functions testgensynthcmd and testemptysynthevent in the kernel/trace/syntheventgentest.c module, which support kernel tracing in Linux operating systems, are related to improper memory release. Exploiting these vulnerabilities could allow an attacker to cause a system...

The vulnerability of the osnoise_hist_main() function in the tools/tracing/rtla/src/osnoise_hist.c file of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the osnoisehistmain function in the tools/tracing/rtla/src/osnoisehist.c file of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `rb_check_bpage()` function in the kernel/trace/ring_buffer.c module, which supports Linux operating system debugging, allows a malicious actor to cause a service failure.

The vulnerability of the rbcheckbpage function in the kernel/trace/ringbuffer.c module, which is part of the Linux kernel’s tracing support, is related to improper validation of the integrity check value. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2026-33249 NATS: Message tracing can be redirected to arbitrary subject

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject,...

CVE-2026-33249 NATS: Message tracing can be redirected to arbitrary subject

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject,...

CVE-2026-33249

NATS-Server vulnerability CVE-2026-33249 affects versions 2.11.0 through 2.11.14 and 2.12.0 through 2.12.5. A valid client using message tracing headers can cause trace messages to be sent to an arbitrary valid subject, including subjects the client cannot publish to; the payload is a valid trace...

CVE-2026-23390

A flaw was found in the Linux kernel. When tracing large scatter-gather lists, which are mechanisms for efficient data transfer, the dmamapsg tracepoint can trigger a performance buffer overflow. This can lead to the tracing buffer becoming too small, potentially causing system warnings and...

SUSE CVE-2026-23309

In the Linux kernel, the following vulnerability has been resolved: tracing: Add NULL pointer check to triggerdatafree If triggerdataalloc fails and returns NULL, eventhisttriggerparse jumps to the outfree error path. While kfree safely handles a NULL pointer, triggerdatafree does not. This cause...

SUSE CVE-2026-23374

In the Linux kernel, the following vulnerability has been resolved: blktrace: fix thiscpuread/write in preemptible context tracingrecordcmdline internally uses thiscpuread and thiscpuwrite on the per-CPU variable tracecmdlinesave, and tracesavecmdline explicitly asserts preemption is disabled via...

SUSE CVE-2026-23380

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARNON in tracingbuffersmmapclose When a process forks, the child process copies the parent's VMAs but the usermapped reference count is not incremented. As a result, when both the parent and child processes exit,...

EUVD-2026-15391

In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dmamapsg tracepoint arrays to prevent buffer overflow The dmamapsg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices like virtio-gpu creating large DRM buffers,...