CVE-2026-80843

Linux kernel IPsec transform (xfrm) subsystem is affected by a memory leak in xfrm_state_construct() . When an authentication algorithm with no sadb_alg_id (e.g., cmac(aes) ) is selected, attach_auth_trunc() allocates x->aalg but leaves x->props.aalgo at zero. The subsequent call to attach_...

CVE-2026-80842

CVE-2026-80842 is a use-after-free in the Linux kernel bridge multicast subsystem, affecting master VLANs . When a master VLAN is deleted, br_multicast_toggle_one_vlan() returns early on the br_vlan_is_brentry() check without clearing BR_VLFLAG_MCAST_ENABLED under br->multicast_lock. The VLAN ...

CVE-2026-80841

CVE-2026-80841 is a use-after-free in the Linux kernel's AF_PACKET TX_RING subsystem. AF_PACKET TX_RING skbs hold a raw pointer to their ring frame; while page references preserve page-backed ring blocks after the ring vector is freed, they do not preserve a vmalloc mapping. This means a late skb...

CVE-2026-80840

CVE-2026-80840 is a slab-out-of-bounds write in the Linux kernel IPv6 Segment Routing (seg6) code. When End.DX4 or End.DT4 decapsulates an inner IPv4 packet via decap_and_validate(), the skb retains stale IP6CB data that overlaps with IPCB fields. A crafted outer Destination Options header sets o...

CVE-2026-80839

CVE-2026-80839 affects the batman-adv module in the Linux kernel . The root cause is that batadv_tvlv_call_handler() sets the 16-bit network and transport header offsets from a received multicast TVLV without validating whether the TVLV end offset is representable. When it exceeds the field's ran...

CVE-2026-80838

CVE-2026-80838 affects the vxlan subsystem in the Linux kernel. The root cause is a race condition during a filtered bulk FDB flush: vxlan_fdb_dst_destroy() unlinks the last remote from a non-nexthop FDB entry before the parent entry is removed from the hash table. During this window, an RCU read...

CVE-2026-80837

CVE-2026-80837 is a use-after-free vulnerability in the Linux kernel's nf_tables subsystem, confirmed on version 7.2.0-rc6 via KASAN. The root cause is a race in nft_quota_obj_eval(), which enqueues a packet-path notification onto nft_net->notify_list via an unlocked list_add_tail(), while nft...

CVE-2026-80836

This Linux kernel vulnerability affects the virtio crypto driver, specifically the virtio_crypto_dataq_akcipher_callback() function. The root cause is that the function sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocat...

CVE-2026-80835

CVE-2026-80835 affects the Linux kernel 's qcom-rng crypto driver, which exposes a Qualcomm hardware RNG through two separate interfaces (crypto_rng and hwrng). The root cause is a lack of synchronization between qcom_rng_generate() and qcom_hwrng_read(), allowing concurrent access to the same ha...

CVE-2026-80834

CVE-2026-80834 affects the Linux kernel 's sun8i-ce crypto driver. The vulnerability is a use-after-free in the ->generate() function of the crypto_rng interface, caused by wait_for_completion_interruptible_timeout() failing to shut down the DMA operation when a signal is sent. The fix removes...

CVE-2026-80833

CVE-2026-80833 affects the sun8i-ss crypto driver in the Linux kernel, specifically the now-removed crypto_rng interface . The driver contained two distinct bugs: a use-after-free in its ->generate() function (caused by wait_for_completion_interruptible_timeout() failing to shut down the DMA o...

CVE-2026-80832

CVE-2026-80832 is a buffer underallocation flaw in the Linux kernel's QCE (Qualcomm Crypto Engine) crypto driver , specifically in qce_aead_ccm_prepare_buf_assoclen(). The AAD buffer size is computed as ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN, while the DMA scatterlist length uses ALIGN(as...

CVE-2026-80831

CVE-2026-80831 affects the Linux kernel 's mxs-dcp crypto driver. In the function mxs_dcp_aes_block_crypt(), the source scatterlist is read via sg_dma_len() without first calling dma_map_sg(), leaving the DMA length field invalid. When CONFIG_NEED_SG_DMA_LENGTH=y is set, this can cause sg_dma_len...

CVE-2026-80830

This vulnerability affects the Linux kernel USB core subsystem, specifically the usb_wakeup_notification() function, which lacked a spin lock. The xHCI driver calls this function from IRQ context, creating a race condition with hub_disconnect() that can lead to dereferencing freed memory (use-aft...

CVE-2026-80829

CVE-2026-80829 is an out-of-bounds write in the Linux kernel 's ALSA usb-audio subsystem, specifically in snd_usbmidi_novation_output(). A malformed or malicious USB device can advertise a bulk OUT endpoint with a wMaxPacketSize of 1, causing the length passed to snd_rawmidi_transmit() to become ...

CVE-2026-80828

CVE-2026-80828 affects the Linux kernel ALSA usb-audio subsystem. When usb_audio_resume() encounters a failure in snd_usb_pcm_resume() or snd_usb_mixer_resume() during system resume, it jumps to err_out, skipping the out: block that restores D0 power state and decrements chip->num_suspended_in...

CVE-2026-80827

CVE-2026-80827 affects the Linux kernel's USB serial option driver (usb-serial-option). The interrupt URB buffer is allocated in setup_port_interrupt_in() using the endpoint's wMaxPacketSize via kmalloc(). When a USB device declares wMaxPacketSize = 8, the buffer is exactly 8 bytes. If the device...

CVE-2026-80826

CVE-2026-80826 is a use-after-free in the Linux kernel's c67x00 USB driver , specifically in c67x00_add_iso_urb(). When TD creation fails for the last packet of an isochronous URB, the driver gives the URB back before updating the endpoint scheduling state. Since c67x00_giveback_urb() frees the U...

CVE-2026-80825

CVE-2026-80825 affects the Linux kernel mt76 WiFi driver for mt7925 USB/SDIO devices (mt7925u). The function mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and USB header onto every skb, assuming sufficient headroom is already present. This assumption holds for locally generated traffic ...

CVE-2026-80824

CVE-2026-80824 is a use-after-free in the Linux kernel's usbfs subsystem. In usbdev_release(), the reference to struct usb_device is dropped before draining completed async URBs; the drain path then dereferences the already-freed device via bus_to_hcd(ps->dev->bus) in dec_usb_memory_use_cou...

CVE-2026-19274

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 contains a vulnerability in the Instana Agent Operator where cluster-scoped RBAC objects are keyed solely by the bare Custom Resource name with no namespace disambiguation. An authenticated Kubernetes tenant can exploit this by ...

CVE-2026-19283

IBM Instana Agent Operator (part of IBM Observability with Instana, builds 1.0.303 through 1.0.323) is vulnerable to information disclosure caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-contro...

CVE-2026-19300

IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by an information disclosure vulnerability in the unauthenticated public flow endpoint. The endpoint uses a heuristic denylist to scrub stored secrets from node templates, but omits fields such as Authentication, X-Session-Id, App-Key, a...

CVE-2026-19299

IBM Langflow OSS versions 1.0.0 through 1.11.2 is affected by an authenticated path traversal vulnerability (CWE-22) in the ChatInput , bundle FileInput , and GitExtractor components. The root cause is that these components resolve file paths without invoking the LANGFLOW_RESTRICT_LOCAL_FILE_ACCE...

CVE-2026-19302

IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to information disclosure via improper symbolic link validation in the GitExtractor component. While the component validates repository URLs to block local clones, it does not inspect the cloned tree for symbolic links. An attacker-con...

CVE-2026-82911

Roskus Prospero Flow CRM before 5.15.11 is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the OrderConfirmController at GET /order/confirm/{order_number} . The root cause is that Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE reque...

CVE-2026-44402

Voltronic Power SNMP Web Pro 1.1 suffers from an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint. The backend fails to validate session cookies (a single Cookie: -http-session-=NOT_VALID header bypasses authentication), and the firmware install proce...

CVE-2026-19304

IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) caused by a URL parser discrepancy in the validate_url_for_ssrf guard. On the RSSReaderSimple and SearXNGToolComponent components, backslash-containing URLs allow an attacke...

CVE-2026-80823

CVE-2026-80823 is a Linux kernel vulnerability in the nfc: st21nfca NFC driver. The function st21nfca_tm_recv_atr_req() validates that a received ATR_REQ frame meets a minimum size and that its self-declared length is at least the struct size, but never checks that the declared length does not ex...

CVE-2026-80822

CVE-2026-80822 affects the Linux kernel's mchp-ipc-sbi mailbox driver. The root cause is a missing null check on the return value of devm_kasprintf() in the function mchp_ipc_get_cluster_aggr_irq() . Without this check, a failed allocation could lead to a NULL pointer dereference. The fix adds a ...

CVE-2026-80821

CVE-2026-80821 affects the Linux kernel 's nvmet pci-epf driver (NVM Express over Fabrics Target, PCIe Endpoint Function). The vulnerability is a reference leak in nvmet_pci_epf_create_cq(): when PCI address-space mapping fails or returns a too-small partial mapping after nvmet_cq_create() succee...

CVE-2026-19305

IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) in multiple components where a remote attacker with no prior authentication can supply attacker-controlled URLs that reach internal network hosts without adequate validation. Affected com...

CVE-2026-85730

smol-toml , a lightweight TOML parser and serializer for JavaScript/TypeScript, is vulnerable to a Denial of Service via malformed TOML documents prior to version 1.7.1 . The root cause lies in src/util.ts, where skipUntil() calls indexOfNewline() and receives -1 at end-of-input, causing the curs...

CVE-2026-19306

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain authenticated path traversal vulnerabilities (CWE-22) in three components: ChatInput (files parameter in build requests uses pathlib join that resets on absolute segments), JigsawStack File Upload (resolves FileInput paths without the access ...

CVE-2026-19645

IBM MQ Agent images (CD versions v1.0.0, v1.0.1, v2.0.0, v2.0.1) are affected by a vulnerability where an authenticated user with a valid session cookie can submit arbitrarily large or computationally expensive requests that hold LLM agent workers for extended periods—ranging from tens of seconds...

CVE-2026-19649

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, as well as IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7, are vulnerable to information disclosure due to improper logging of database credentials in Adapter nodes. A local attacker with no req...

CVE-2026-5522

IBM QRadar SIEM versions 7.5.0 through 7.5.0 UP15 IF05 contain hard-coded credentials (CWE-798) used for inbound authentication, outbound communication to external components, or encryption of internal data. The vulnerability is rated CVSS 6.7 (Medium) with a local attack vector, high privileges ...

CVE-2026-77822

IBM ContextForge MCP Gateway (≤ v1.0.8) is vulnerable to server-side request forgery (SSRF) via DNS rebinding in its Agent-to-Agent (A2A) invocation endpoint (POST /a2a/{agent_name}/invoke). Unlike other outbound egress paths in the gateway, the A2A path does not pin the DNS-resolved IP address a...

CVE-2026-80820

CVE-2026-80820 affects the Linux kernel's XFS filesystem , specifically the online scrub (fsck) functionality. The root cause is a livelock that occurs when an unlinked inode list contains a circular loop , causing the scrub process to get stuck in an infinite cycle. The fix, referenced in upstre...

CVE-2026-80819

CVE-2026-80819 is a null pointer dereference in the Linux kernel 's Bluetooth RFCOMM subsystem. The flaw occurs when rfcomm_sock_recvmsg() calls rfcomm_dlc_accept() without holding rfcomm_mutex. A remote peer can trigger the bug by sending a DISC frame on a deferred-setup DLC, which clears d->...

CVE-2026-80818

CVE-2026-80818 is a use-after-free in the Linux kernel's iommu/tegra241-cmdqv driver. During a devres unwind (failed probe or unbind), the SMMU command queue is freed before arm_smmu_impl_remove() invokes tegra241_cmdqv_remove_vintf(), which issues a CMD_SYNC on the already-freed queue memory. Th...

CVE-2026-80817

A NULL pointer dereference in the Linux kernel's iommu/iommufd subsystem (drivers/iommufd/ioas.c) can cause a kernel crash. The root cause is a race condition : iopt_map_pages() inserts an IOAS area into the interval tree with area->pages still NULL, then later fills it under a different lock....

CVE-2026-80816

This Linux kernel vulnerability affects the ALSA FCP (Firmware Configuration Protocol) module. The root cause is that fcp_init_notify() shared a URB (mixer->urb ) with the optional UAC2 status interrupt endpoint . On devices exposing that endpoint, the early-return path fired prematurely, leav...

CVE-2026-80815

CVE-2026-80815 affects the ALSA scarlett2 driver in the Linux kernel, used for Focusrite Scarlett 2nd-generation USB audio interfaces. The root cause is that scarlett2_init_notify() shared mixer->urb with the UAC2 status interrupt endpoint managed by mixer.c. On devices with that endpoint, the...

CVE-2026-80814

A vulnerability in the Linux kernel 's rndis_host driver (a USB RNDIS host driver) was identified in the rndis_rx_fixup() function. The root cause is a missing overflow check: if data_offset + data_len + 8 wraps around, it enables an out-of-bounds (OOB) read of the USB data buffer. The fix, as de...

CVE-2026-80813

CVE-2026-80813 affects the Linux kernel nvmet (NVM Express Target) subsystem. A NULL pointer dereference occurs in nvmet_execute_identify_nslist() when a host issues an Identify command with CNS 07h (Active Namespace ID List for a specific I/O Command Set). The function dereferences req->ns-&g...

CVE-2026-80812

CVE-2026-80812 affects the Linux kernel 's ALSA dummy driver. The function snd_dummy_probe() does not validate the devptr->id (card index) value, assuming it is always within range. While this is safe for devices created at module probe time, a device manually bound via the sysfs interface can...

CVE-2026-80811

CVE-2026-80811 is a memory leak in the Linux kernel's io_uring/cmd subsystem. An io_async_cmd carries an iovec array that is allocated when the vector must grow and retained across recycling via ctx->cmd_cache. On two code paths, the iovec is never freed: io_req_uring_cleanup() only clears the...

CVE-2026-80810

CVE-2026-80810 is an out-of-bounds write/read vulnerability in the Linux kernel's io_uring resource management subsystem. The root cause is an integer overflow in io_vec_fill_bvec(), which computes the folio size using a plain int 1 shifted by imu->folio_shift. When folio_shift is 32 or greate...

CVE-2026-80809

CVE-2026-80809 affects the Linux kernel's ocfs2 filesystem . The root cause is that ocfs2_calc_xattr_set_need() fails to reserve metadata blocks for a new xattr value's extent tree when the file already has an external xattr block, leaving meta_ac as NULL. On a fragmented filesystem , this causes...