CVE-2026-18107

A flaw was found in CRIU's handling of restartable sequences rseq du...

CVE-2026-67182

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnera...

CVE-2026-54332

gopacket provides packet processing capabilities for Go. In version 1...

CVE-2026-54345

gopacket provides packet processing capabilities for Go. In version 1...

CVE-2026-67181

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnera...

CVE-2026-66746

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulner...

CVE-2026-66754

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerabili...

CVE-2026-66753

tiny-http through 0.12.0 contains an HTTP header injection vulnerabili...

CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerabil...

CVE-2026-18047

A flaw was found in Dogtag PKI's ACME responder where the web.xml secu...

CVE-2026-62434

A guest started with Populated on Demand enabled PoD can attempt to...

CVE-2026-62433

Parts of the DMOP handling code assumes the caller has provided the r...

CVE-2026-62432

The EVTCHNOPexpandarray hypercall checks for whether FIFO event chan...

CVE-2026-62431

The logic to handle periodic Viridian STIMERs performs a division with...

CVE-2026-62430

Accesses to the CMOS memory contents are done using an indirect IO por...

CVE-2026-62429

Accessing the vNUMA configuration data of a guest is still possible wh...

CVE-2026-62435

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-62436

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-62428

When grant-copy operations are processed, the respective grant may or...

CVE-2026-62426

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-62427

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-42495

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-62425

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-62424

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-62423

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-42494

This CNA information record relates to multiple CVEs; the text explai...

CVE-2026-42492

Xenstore, to have an up-to-date picture of the entire system, wants to...

CVE-2026-42493

Addressing certain issues, in particular related to operations which m...

CVE-2026-58222

Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes...

CVE-2026-6949

TSIG packet with name compression can crash DNS...

CVE-2026-58216

An authenticated user could possibly crash a KDC process...

CVE-2026-58218

DNS signing DoS via TKEY name cache exhaustion...

CVE-2026-58224

The CTDB protocol has bounds checking issues...

CVE-2026-58221

Samba AD authenticated LDAP access domain takeover...

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYS...

CVE-2026-64555

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSREL2 restore in kvmhyphandlemops kvmhyphandlemops resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpucpsr and writing the result directly into hardware. In...

CVE-2026-64554

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment brip6fragment gets prevhdr, a pointer into the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb skbchecksumhelp reallocates the head via...

CVE-2026-64553

In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...

CVE-2026-64552

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

CVE-2026-64550

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnetmapingresshandler passes the skb straight to rmnetmapingresshandler, skipping the length validation that...

CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64549

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...

CVE-2026-64547

In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packetlen before pad-byte access in rxfixup For an even packetlen, net1080rxfixup reads the pad byte at skb-datapacketlen before the skb-len != packetlen check further down, and packetlen is only bound...

CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

CVE-2026-64545

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without a NULL check, but that helper returns NULL when the receiving device has no upper-master...

CVE-2026-64544

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...

CVE-2026-64543

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with tipcdiscdelete's plain kfree, but tipcdiscrcv still dereferences b-disc in RX softirq under rcureadlock tipcudprecv - tipcrcv - tipcdiscrcv...

CVE-2026-64542

In the Linux kernel, the following vulnerability has been resolved: ipv6: ndisc: fix NULL deref in acceptuntrackedna acceptuntrackedna re-fetches the inet6dev with in6devgetdev and dereferences idev-cnf.acceptuntrackedna without a NULL check, even though its only caller ndiscrecvna already fetche...

CVE-2026-64541

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...