74465 matches found
CVE-2026-104786
SQUID-2026:7...
CVE-2026-108147
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...
CVE-2026-114582
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...
CVE-2026-111211
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize, used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attacker...
CVE-2026-113733
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...
CVE-2026-111362
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...
CVE-2026-113593
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The django.middleware.cache.UpdateCacheMiddleware and the django.views.decorators.cache.cachepage decorator generate identical cache keys for requests that omit a header listed in the response’s Vary...
CVE-2026-120436
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbgdecmergeplanes overflows th...
CVE-2026-120433
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...
CVE-2026-120432
Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into...
CVE-2026-120434
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack arr...
CVE-2026-120435
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...
CVE-2026-120431
Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the...
CVE-2026-120437
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's getpixel function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values excee...
CVE-2026-99250
In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during SMP setup. The reports also show that...
CVE-2026-99263
In the Linux kernel, the following vulnerability has been resolved: iouring/poll: avoid retry wakeup loss when dropping ownership If a wakeup sets IOPOLLRETRYFLAG between the owning task consuming the existing instance of IOPOLLRETRYFLAG and the loop check of iopollcheckevents, then we stall on...
CVE-2026-99259
In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegrapmcentersuspendmode function is being triggered because the earlypmc-rate variable is never configured and hence, always 0. Thi...
CVE-2026-99266
In the Linux kernel, the following vulnerability has been resolved: iouring/zcrx: fix buffer offsets in areas above 4GB iozcrxqueuecqe computes the offset of the buffer in its area from netiovidx, which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64...
CVE-2026-99268
In the Linux kernel, the following vulnerability has been resolved: iouring: wake ring pollers for local taskwork With IORINGSETUPDEFERTASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via...
CVE-2026-99264
In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "iouring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another...
CVE-2026-99244
In the Linux kernel, the following vulnerability has been resolved: pidnamespace: prevent TIFNOTIFYSIGNAL from interrupting the reaper Since commit 7fea700e04bd "zappidnsprocesses: clear TIFNOTIFYSIGNAL along with TIFSIGPENDING" zappidnsprocesses clears TIFNOTIFYSIGNAL before every kernelwait4...
CVE-2026-99248
In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood The devres conversion replaced manual pmruntimeenable/disable with devmpmruntimesetactiveenabled and dropped the remove-time runtime PM teardown. The managed release...
CVE-2026-99267
In the Linux kernel, the following vulnerability has been resolved: iouring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined a...
CVE-2026-99253
In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: rearm local work wake up before sleep iouringtrycancelrequests sets -cqwaitnr to 1 so that the next ioreqlocalworkadd wakes the cancelling task. The add that takes the count to zero is the only one that wakes, lat...
CVE-2026-99265
In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...
CVE-2026-99251
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in initvpindex There is a retry loop in initvpindex where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HKTYPEMANAGEDIRQ...
CVE-2026-99247
In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers, tracingdisabled is left set to 1 and the global trace array events...
CVE-2026-99243
In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation task work iowqexitworkers cancels task work for queued worker creation with taskworkcancelmatch. That has a plain load of task-taskworks. ioqueueworkercreate adds the new entry an...
CVE-2026-99245
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix keyrejectandlink race with keyring restriction The restrictlink check in keyrejectandlink is done before taking the keyring semaphore, racing with a concurrent keyringrestrict that installs the restriction while holding...
CVE-2026-99256
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rwsemaphore for backgroundworklock. Write locks on rwsemaphores have strict owner semantics, but there was no guarantee that the process that locked...
CVE-2026-99246
In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...
CVE-2026-99258
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...
CVE-2026-99249
In the Linux kernel, the following vulnerability has been resolved: pidnamespace: make zappidnsprocesses freezable When the init of a pid namespace exits, zappidnsprocesses waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies...
CVE-2026-99261
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...
CVE-2026-99269
In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and...
CVE-2026-99255
In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks everywhere a request can be, and goes to sleep if it found nothing to...
CVE-2026-99257
In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...
CVE-2026-99262
In the Linux kernel, the following vulnerability has been resolved: iouring/timeout: don't lose a cancel as io-wq arms a timeout An IORINGOPTIMEOUT run by io-wq, because of IOSQEASYNC, has the same problem as poll, futex and waitid. iowqsubmitwork looks at IOWQWORKCANCEL once, before it issues th...
CVE-2026-99254
In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork asks each task which has used the ring to remove its tctx node, by taskwork, and repeats that until the list is empty. iotctxexitcb doesn't touch the node while...
CVE-2026-99260
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfsnewattrflags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated...
CVE-2026-99252
In the Linux kernel, the following vulnerability has been resolved: iouring/mpscq: disable preemption while pushing A push makes the node the new tail, and then links it to its predecessor. In between the queue isn't empty, but mpscqpop can't get at the node. The consumers deal with that by tryin...
CVE-2026-120457
libaec through 1.1.7 contains an out-of-bounds read vulnerability in msedecode in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or lea...