CVE-2026-80888

This Linux kernel vulnerability affects the drm/vmwgfx paravirtualized graphics driver. The function ttm_prime_fd_to_handle() returns -ENOSYS when an imported fd's dma_buf->ops do not match the ttm_object_device's ops, but fails to release the reference previously acquired by dma_buf_get(). As...

CVE-2026-80887

CVE-2026-80887 is an integer overflow vulnerability in the Linux kernel 's drm/vmwgfx (VMware SVGA virtual GPU) driver. In vmw_shader_define(), the bounds check (u64)buffer->tbo.base.size guest_memory_offset and forwarded to host SVGA shader-create commands, potentially enabling out-of-bounds ...

CVE-2026-19534

CVE-2026-19534 affects undici , the Node.js HTTP client library. During the WebSocket opening handshake, if a server's 101 response includes a Sec-WebSocket-Protocol header that the client never requested, undici dereferences a null value while checking it against the requested subprotocol list, ...

CVE-2026-85654

Amazon awslabs.dynamodb-mcp-server contains a code injection vulnerability in its CDK generator component. The root cause is improper neutralization of special elements used in a template engine , allowing a context-dependent actor to execute arbitrary code on the host that deploys the generated ...

CVE-2026-84890

undici , the Node.js HTTP client, is vulnerable to a denial of service via unbounded decompression of compressed responses. The decompress interceptor processes response bodies based on the untrusted Content-Encoding header. Although the number of encoding layers is capped, the total decompressed...

CVE-2026-84933

undici (Node.js HTTP client) has a vulnerability in its cache interceptor that fails to handle the Set-Cookie response header in its cache path—neither refusing to store nor stripping it. In shared cache mode (the default), a cacheable response carrying a Set-Cookie header is stored and re-served...

CVE-2026-84947

CVE-2026-84947 affects undici (Node.js HTTP client), specifically its dump interceptor . When a chunked response (no Content-Length) exceeds the configurable maximum body size, the interceptor signals completion early without pausing or aborting the request. The underlying parser then delivers a ...

CVE-2026-80886

CVE-2026-80886 affects the Linux kernel MSM (Qualcomm) serial driver . A race condition occurs when concurrent writes from userspace (which initiate an asynchronous DMA transfer and release the port lock) and the kernel printk path (which grabs the lock and reconfigures the UART for PIO ) collide...

CVE-2026-80885

CVE-2026-80885 affects the AFS (Andrew File System) subsystem in the Linux kernel . The vulnerability involves an uncancelled rxrpc out-of-band (OOB) message handler , which is typically used to respond to security challenges. If the OOB handler is not properly cancelled, it may continue processi...

CVE-2026-80884

CVE-2026-80884 affects the Linux kernel's NTB (Non-Transparent Bridge) driver . The root cause is that the driver was modifying the DMA handle before passing it to dma_free_attrs, violating the DMA API contract that requires the exact dma_handle originally returned by the allocation function. Thi...

CVE-2026-80883

CVE-2026-80883 affects the Linux kernel 's drm/tegra subsystem, specifically the gr2d and gr3d drivers. The root cause is a race condition : the host1x_client_register() function is called before the address register map initialization loop completes, making the device available to userspace prem...

CVE-2026-80882

This vulnerability affects the Linux kernel 's Tegra crypto driver , specifically the CCM (Counter with CBC-MAC) implementation in the function tegra_ccm_do_one_req. The root cause is that when the input buffer allocation fails, the ENOMEM error value is not properly set and returned, leading to ...

CVE-2026-80881

This Linux kernel vulnerability affects the OCFS2 (Oracle Cluster File System 2) filesystem in the ocfs2_read_blocks() function. The root cause is an incorrect assumption of exclusive ownership of buffer heads returned by sb_getblk(): when put_bh() does not drop the reference count to zero, the b...

CVE-2026-80880

CVE-2026-80880 affects the IB/mlx5 InfiniBand driver in the Linux kernel. The vulnerability stems from improper handling of implicit ODP (On-Demand Paging) rereg_mr : due to child mkeys in the implicit ODP configuration, the parent mkey could not be modified in place and required a full rebuild. ...

CVE-2026-80879

CVE-2026-80879 affects the OCFS2 filesystem in the Linux kernel. The vulnerability is a circular locking dependency involving three system inode locks: INODE_ALLOC_SYSTEM_INODE , EXTENT_ALLOC_SYSTEM_INODE , and ORPHAN_DIR_SYSTEM_INODE . Specifically, ocfs2_dio_end_io_write() acquires EXTENT_ALLOC...

CVE-2026-80878

CVE-2026-80878 is a resource leak in the Linux kernel's AFS (Andrew File System) module. The function afs_lookup_volume_rcu() fails to release a dying volume when the preceding afs_try_get_volume() call fails, resulting in a leak of an ungot volume . The fix is provided in kernel patches (commits...

CVE-2026-80877

CVE-2026-80877 is a memory leak in the Linux kernel's AFS (Andrew File System) module. The bug is in afs_update_cell() : when the new server list is empty (nr_servers == 0), the newly allocated vllist is never freed because the old list is only displaced if it is also empty. Each such event leaks...

CVE-2026-80876

CVE-2026-80876 affects the Linux kernel ring-buffer subsystem on architectures where RB_FORCE_8BYTE_ALIGNMENT is true (observed on riscv64 with CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y). The root cause is a mismatch in length calculation: rb_calculate_event_length() unconditionally reserves sizeof(even...

CVE-2026-80875

In the Linux kernel , the IPVS (IP Virtual Server) subsystem contained a bug in TCP state lookup for IPv6 packets. The code reparsed the socket buffer to locate the TCP header using a fixed offset of sizeof(struct ipv6hdr), rather than the already-computed transport-header offset stored in iph.le...

CVE-2026-80874

This CVE affects the Linux kernel on the arm64 Renesas ironhide platform. The DBSC5 DRAM controller uses inline ECC, which relies on specific DRAM address ranges that must not be accessed by the OS. The vulnerability is a device tree (dts) omission : the inline ECC carveout areas were not describ...

CVE-2026-80873

This Linux kernel bug affects KVM arm64 nested virtualization . The root cause is that kvm_inject_el2_exception() writes the ESR_EL2 syndrome register for synchronous exceptions but not for SError exceptions, and enter_exception64() does not write ESR_ELx for any exception type. As a result, a gu...

CVE-2026-80872

CVE-2026-80872 affects the Linux kernel 's ALSA HDA TAS2781 driver (I2C and SPI variants). The TAS2781 driver queues RCA firmware loading via request_firmware_nowait(), whose async callback uses driver-private HDA state. During component unbind, controls and DSP state are removed immediately, and...

CVE-2026-80871

CVE-2026-80871 affects the Linux kernel 's xilinx-trng crypto driver. The crypto_rng interface implemented by the driver was unused in practice and carried two latent bugs: (1) xtrng_trng_generate() could return success without filling all requested bytes, and (2) broken locking in xtrng_hwrng_tr...

CVE-2026-80870

CVE-2026-80870 affects the Linux kernel component drm/amdkfd (AMD Kernel Fusion Driver). The vulnerability exists in the CRIU restore flow, where userspace-provided object IDs are passed to idr_alloc() without validation in kfd_criu_restore_event() and criu_restore_memory_of_gpu() . If a restored...

CVE-2026-80869

CVE-2026-80869 affects the Linux kernel NTFS filesystem driver. In ntfs_read_inode_mount() , the $MFT attribute-list walk validated only that 6 bytes of each entry were in range, then read lowest_vcn (offset 8, 8 bytes) and mft_reference (offset 16) — fields beyond the proven boundary. Since al_e...

CVE-2026-80868

CVE-2026-80868 affects the Linux kernel 's ntfs3 filesystem driver. The bug occurs in iomap_write_end_inline, where inline_data was allocated via kmemdup , which provides no guarantee of page alignment . The iomap_inline_data_valid check expects the data to fit within a page boundary, so the misa...

CVE-2026-80867

CVE-2026-80867 affects the Linux kernel on the Alpha architecture. The pci_mmap_resource() function failed to check security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to mmap PCI BARs . The generic (non-Alpha) version has enforced this check since commit eb627e17727e to prevent D...

CVE-2026-80866

CVE-2026-80866 affects the Linux kernel TIPC subsystem (specifically tipc_exit_net()). A prior commit introduced a busy-wait loop that spins while waiting for pending UDP bearer cleanup work to complete. When cond_resched() is a NOP—common for high-priority tasks or kernels built with CONFIG_PREE...

CVE-2026-80865

CVE-2026-80865 affects the Linux kernel BPF subsystem , specifically the copy_user_syms function. The root cause is a missing access_ok call before using __get_user on a user-space pointer array, which could allow an invalid user-space pointer to be dereferenced without prior validation. The fix ...

CVE-2026-84961

CVE-2026-84961 affects undici , the Node.js HTTP client library. The BalancedPool constructor passes its entire options object through an internal JSON deep-clone , which silently discards any function-valued TLS options (e.g., a custom checkServerIdentity callback or a custom connector in the co...

CVE-2026-13297

IBM Verify Identity Access and IBM Security Verify Access contain an information disclosure vulnerability in the Advanced Access Control component. The flaw can be exploited over the network with low complexity, requires no prior authentication, and results in a high impact to confidentiality wit...

CVE-2026-14350

IBM Cloud Pak for Data System (CPDS 1.0), versions 11.3.0.2 through Interim Fix 1 , is vulnerable to log injection (CWE-117) caused by improper neutralization of special elements when writing to log files. An unauthenticated, remote attacker can inject data into log messages, resulting in low int...

CVE-2026-14470

IBM Langflow OSS versions 1.0.0 through 1.10.2 is vulnerable to a path traversal flaw (CWE-22) in its file and knowledge base components. An authenticated attacker can send a crafted URL request containing ../ sequences to read arbitrary files on the system. Per the IBM security bulletin, in the ...

CVE-2026-16180

CVE-2026-16180 affects IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7. The vulnerability resides in the Toolkit component, where an authenticated user can trigger a denial-of-service condition...

CVE-2026-85008

undici (the Node.js HTTP client library) contains a caching integrity flaw in its cache interceptor . The skip-list logic is built by subtracting configured methods from the set of safe methods, so unsafe methods (POST, PUT, DELETE) are never added to the skip list and fall through to the full ca...

CVE-2026-16660

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain an out-of-bounds read (CWE-125) that allows a remote attacker with no privileges to cause a denial of service . The CVSS v3.1 score is 5.3 (MEDIUM) , reflecting a network vector, low complexity, and low availability impact with no effect on ...

CVE-2026-16689

IBM App Connect Enterprise (versions 13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0–10.1.0.7) are affected by improper logging of credentials in Adapter nodes , allowing a local attacker to obtain sensitive information. The vulnerability requires no privileg...

CVE-2026-16693

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by a cryptographic weakness in Digital Certificate Manager (DCM) (5770-SS1 Option 34). The vulnerability stems from hardcoded cryptographic constants used to obfuscate encryption keys, classified as CWE-327 (Use of a Broken or Risky Cryptographic...

CVE-2026-16826

CVE-2026-16826 affects the Debug Server component of IBM i versions 7.3, 7.4, 7.5, and 7.6. The root cause is CWE-78 (OS Command Injection) : improper neutralization of special elements used in an OS command, allowing a local attacker with low privileges to execute arbitrary commands . NVD scores...

CVE-2026-16892

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by an improper authentication flaw (CWE-287) in the Network Authentication Service (NAS) , where a remote authenticated attacker can bypass security restrictions during service-name matching . The vulnerability carries a CVSS 3.1 score of 5.4 (ME...

CVE-2026-16941

IBM i versions 7.6, 7.5, and 7.4 (license product 5770-SS1 ) are affected by an incorrect authorization flaw (CWE-863 ) that allows a remote authenticated attacker to modify certain system messages , resulting in a limited integrity impact (CVSS 4.3, MEDIUM). No confidentiality or availability im...

CVE-2026-17057

IBM i versions 7.3 through 7.6 are affected by a vulnerability in the Network File System (NFS) component caused by missing authentication for critical functions (CWE-306). A remote attacker can trigger a denial of service and impact data integrity without requiring privileges or user interaction...

CVE-2026-17207

CVE-2026-17207 is a buffer overflow (CWE-787: Out-of-bounds Write) in the Network File System (NFS) component of IBM i versions 7.3, 7.4, 7.5, and 7.6. A remote, unauthenticated attacker can trigger it over the network to cause a denial of service and compromise data integrity . NVD rates it CVSS...

CVE-2026-17255

IBM i versions 7.6, 7.5, 7.4, and 7.3 are affected by a denial of service vulnerability caused by improper validation of the prefix length in ICMPv6 Router Advertisements , classified as CWE-787 (Out-of-bounds Write) . A remote attacker can trigger a DoS with low complexity and no privileges requ...

CVE-2026-17259

CVE-2026-17259 affects the Debug Server component of IBM i versions 7.3 through 7.6. A remote authenticated attacker can trigger a stack-based buffer overflow (CWE-121), resulting in a denial of service with low availability impact and no impact on confidentiality or integrity. The attack vector ...

CVE-2026-17270

CVE-2026-17270 is one of eight vulnerabilities in the IBM i Debug Server component affecting versions 7.3, 7.4, 7.5, and 7.6 . The root cause is a stack-based buffer overflow (CWE-121) that allows a local attacker to cause a denial of service . The assigned CVSS v3.1 score is 4.3 (Medium) with a ...

CVE-2026-17273

CVE-2026-17273 affects the Debug Server component in IBM i versions 7.3, 7.4, 7.5, and 7.6. A remote authenticated attacker with low privileges can trigger a NULL pointer dereference (CWE-476), resulting in a denial of service with no impact on confidentiality or integrity. The IBM-assigned CVSS ...

CVE-2026-17274

CVE-2026-17274 affects the Debug Server component of IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerability stems from predictable server seeds (CWE-330: Use of Insufficiently Random Values), allowing a remote authenticated attacker to bypass security restrictions with low complexity over the n...

CVE-2026-17440

IBM App Connect Enterprise (13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0 through 10.1.0.7) are vulnerable to a denial of service via uncontrolled recursion in Adapter nodes . A local attacker with low privileges can trigger the condition, r...

CVE-2026-85152

undici (the Node.js HTTP client) versions 8.10.0 through 8.10.2 are vulnerable to cross-origin cache poisoning when the cache or deduplicate interceptor is composed directly onto a Client or Pool. The root cause is that the internal cache key falls back to an empty origin string, so a cacheable o...