PT-2026-97902

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs filesystem where extending a file size across an unaligned EOF End of File boundary—via operations such as truncate, fallocate, or write—may fail to properly...

CVE-2026-54767

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker...

CVE-2026-54767 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker...

EUVD-2026-82576

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker...

CVE-2026-54767

WeGIA , a web manager for charitable institutions, is affected by a critical (CVSS 9.1) vulnerability prior to version 3.8.5 . The file deletar_socios.php exposes an unauthenticated GET endpoint where the chave parameter is validated only against a hardcoded chave_correta value embedded in the pu...

CVE-2026-54767 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker...

CVE-2026-54767: Missing Authentication for Critical Function

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletarsocios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chavecorreta value embedded in the public source repository. A remote attacker...

PT-2026-95160

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description An unauthenticated GET endpoint at 'web/html/socio/sistema/controller/deletar socios.php' validates the chave parameter against a hardcoded chave correta value found in the public source repository. A...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed to avoid out-of-bounds access in f2fstruncateinodeblocks syzbot reports an UBSAN issue as follows: ------------ cut here --- UBSAN: Array index out of bounds in fs/f2fs/node.h:381:10 Index 18446744073709550692 is out ...

Astra Linux – Vulnerability in Node-Elliptic

The Elliptic package 6.5.7 for Node.js, in its ECDSA implementation, does not correctly verify valid signatures when the hash contains at least four leading 0 bytes, and when the order of the elliptic curve’s base point is smaller than the hash, due to an truncateToN anomaly. This results in vali...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: hfsplus: prevented corruption during the shrinking of truncate operations. I believe there are some issues introduced by commit 31651c607151 “hfsplus: avoided deadlock during file truncation”. HFS+ uses extent records, which alwa...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regular file, executing the truncate system call will invoke the dotruncate routine, resulting in an uninitialized runlock error reported by syzbo...

SUSE CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89639

A flaw was found in the Linux kernel's Common Internet File System CIFS implementation. When a file is truncated, the cifsdotruncate function does not properly invalidate the file system cache fscache. This oversight can lead to stale cached data being served to users, potentially resulting in...

AZL-100142 CVE-2026-89713 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

UBUNTU-CVE-2026-89639

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifsinvalidatecache in cifsdotruncate for OTRUNC cifsdotruncate is invoked from cifsopen without irwsem, so it cannot use cifsresizefilelocked to perform a proper fscache cookie resize. Instead, add cifsinvalidatecache...

CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

PT-2026-90355

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CIFS component where cifs do truncate is called from cifs open without holding i rwsem, preventing the use of cifs resize file locked for proper fscache cookie...