EUVD-2026-93154

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

CVE-2026-98226

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

PT-2026-106698

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xfrm component where the xfrm trans reinject function was converted from a tasklet to a workqueue, causing the reinjection loop to run in process context instead o...

CVE-2026-98369: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

Linux Distros Unpatched Vulnerability : CVE-2026-98369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious R...

CVE-2026-105760

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level mediaiokwargs field to select the GLMGA video backend and supply large values for the fps and maxframes options without a strict work ceiling. GLMGA constructs and deduplicates a...

CVE-2026-105646

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105646

The Ghost Node.js content management system is vulnerable to a Regular Expression Denial of Service (ReDoS) in its content import functionality. Specifically, versions 4.0.0 through 6.67.0 allow a crafted content import file to cause excessive CPU usage , potentially rendering the server unrespon...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645

The Ghost Node.js content management system is vulnerable to a Regular Expression Denial of Service (ReDoS) in its external media inliner component. Versions from 5.37.0 until 6.67.0 are affected, where a crafted request can trigger excessive CPU usage, leading to server unresponsiveness. Exploit...

CVE-2026-105645

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ICMP: Prevent possible NULL dereferencing from icmpbuildprobe. The first issue involves a double call to indevgetrcu; the second call might return NULL. if indevgetrcudev && indevgetrcudev-ifalist The second issue involves...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Fixed the nullptrdereference error when the journal load failed. During the mounting process, if the journal function fails due to a too-short journal, it causes jbd2journalload to fail with a NULL jsbbuffer. Subsequently,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nfnetlinkqueue: acquire rcureadlock in instanceDestroyrcu syzbot reported that nfreinject could be called without rcureadlock: WARNING: suspicious RCU usage 6.9.0-rc7-syzkaller-02060-g5c1672705a1a 0 Not tainted...