CVE-2026-115585

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing...

CVE-2026-115580

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in...

CVE-2026-115572

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such as pages to trigger repeated full-file recovery loads and long runtimes when accessed. This issue...

CVE-2026-115683

...

CVE-2026-115863

ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in getdomains in gdhcp/client.c. It copies a fixed NSMAXDNAME 1025 bytes from a DHCPv6 DOMAINLIST option 24 value into a 1026-byte stack buffer dnsname regardless of the actual option length, then walks...

CVE-2026-115567

Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::polltick including .tick.await and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The rac...

CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event...

CVE-2026-106069

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

CVE-2026-106070

A flaw in the Node.js zlib.ZipFile API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When zipEntry.modified is read on an archive whose local header does not match its central directory, either directly or while...

CVE-2026-106071

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...

CVE-2026-106073

A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...

CVE-2026-105483

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...

CVE-2026-106072

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1. tls.checkServerIdentity did not classify these hosts as IP...

CVE-2026-106074

A flaw in Node.js crypto causes the internal entropy caches used by crypto.randomUUID, crypto.randomUUIDv7, and crypto.randomInt to be saved into user-land startup snapshots --build-snapshot and single executable applications built with useSnapshot. If any of these functions, or an API that relie...

CVE-2026-105482

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

CVE-2026-49442

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. When a user attempts to log in, the application returns slightly different error messages depending on...

CVE-2026-39902

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...

CVE-2026-46531

Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm default General Administration role can...

CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

CVE-2026-99087

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the device in the 'R' mode, a crash in dmintegrityresume happens because th...

CVE-2026-99086

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor...

CVE-2026-99085

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

CVE-2026-99084

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99082

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvmmemslots...

CVE-2026-55888

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

CVE-2026-55889

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...

CVE-2026-99081

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...

CVE-2026-99080

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

CVE-2026-99079

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AFXDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx...

CVE-2026-99078

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...

CVE-2026-99077

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99076

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

CVE-2026-99075

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

CVE-2026-99074

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...

CVE-2026-99073

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99072

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...

CVE-2026-99071

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

CVE-2026-99070

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99069

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-99068

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

CVE-2026-99067

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99065

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-99064

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99062

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99061

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99060

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...