CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-98379 netfilter: ip6t_rpfilter: reject routes without inet6_dev

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trpfilter: reject routes without inet6dev ip6routelookup can return an error-free route whose rt6iidev is NULL. Lowering an external nexthop device's MTU below IPV6MINMTU tears down its inet6dev while fib6ifdown...

CVE-2026-98378 bpf: Skip unsettled links in link iterator

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpflinkprime inserts a link into linkidr before anoninodegetfile succeeds and before bpflinksettle publishes the ID in link-id. bpflinkbyid treats such an ID-zero link as unsettled, but...

CVE-2026-98376 bpf: Use array_map_meta_equal for percpu array inner map replacement

In the Linux kernel, the following vulnerability has been resolved: bpf: Use arraymapmetaequal for percpu array inner map replacement percpuarraymapops.mapmetaequal points to the generic bpfmapmetaequal, which does not compare maxentries. When a percpu array serves as an inner map, replacing it...

CVE-2026-98377 vlan: require the MAC header to be present in __vlan_insert_inner_tag()

In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in vlaninsertinnertag vlaninsertinnertag only guarantees head room via skbcowhead, never that maclen bytes of MAC header are present. Its ETHHLEN wrappers - vlaninserttag under...

CVE-2026-19575 Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code

The user-mode verification handler for the devicedeinit system call, zvrfydevicedeinit in kernel/device.c, validated its dev argument with KSYSCALLOBJINITdev, KOBJANY. kobjectvalidate short-circuits its type comparison when the requested type is KOBJANY, so the check reduced to "this pointer is t...

CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...

CVE-2026-19574 ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation

The ARM64 MMU back-end allocated address space identifiers ASIDs for memory domains with a bare round-robin counter in archmemdomaininit arch/arm64/core/mmu.c. VMASIDBITS is 8, so only 255 ASIDs exist; once the counter wrapped, archmemdomaininit could hand an ASID to a new domain while a still-li...

CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...

CVE-2026-19570 Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bapbroadcastsink.c copies subgroup metadata from a received Basic Audio Announcement BASE into the static Broadcast Audio Scan Service parameter structure modsrcparam without any bounds check. In basesubgroupmetacb the destination element was...

CVE-2026-98375 xen/netfront: drop RX packets with a short Ethernet header

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handleincomingqueue pulls pullto bytes into the head before calling ethtypetrans. pullto is the length of the first RX slot, capped at RXCOPYTHRESHOLD, and that length...

CVE-2026-101028 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 lib/ash/actions/aggregate.ex applied only the root resource's read policy before running the...

CVE-2026-107910

An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...

CVE-2026-107911

A type confusion vulnerability in the readflags function src/commands/cmddispatcher.c in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any clie...

CVE-2026-107909

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CVE-2026-107908

A heap-based out-of-bounds write in the BoltReadHandler function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt...

CVE-2026-107914

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export...

CVE-2026-7826

A heap-based out-of-bounds read in the BufferSerializerIOv2ReadBuffer function src/serializers/serializerio.c in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands for example, against an instance with no password configured to cause a denial of service or...

CVE-2026-7827

A stack-based buffer overflow in the RdbLoadEntity function of the RDB graph decoders src/serializers/decoders//decodegraphentities.c in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands for example, against an instance with no password configured to cause a...

CVE-2026-5759

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders src/serializers/decoders//decodegraphentities.c in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands for example, against an instance with no passwor...

CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPPTAGZERO, but addjob converts these separators to IPPTAGJOB. During job startup, getoptions/ipplength subsequentl...

CVE-2026-107888

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler...

CVE-2026-107886

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, addclass frees pclass-printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer;...

CVE-2026-107885

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs. The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that...

CVE-2026-107802 SumatraPDF — Windows command-line argument injection in AI selection-translate

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp, BuildClaudeTranslateCmdLineTemp, and...

CVE-2026-107738 SumatraPDF: Untrusted binary record offset used without lower-bound validation

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107736 SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values ca...

CVE-2026-107735 SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a...

CVE-2026-107734 SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW. A user...

CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...

CVE-2026-107732 SumatraPDF: Markup/command-link injection into UI notification text

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink dispatches its CmdExec command and can...

CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

CVE-2026-107729 SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INTMAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is...

CVE-2026-107728 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve on a synchronous field resolver evaluates the result of haspermission for truthiness. When a custom permission declares haspermission as a normal function but returns an awaitable,...

CVE-2026-107727 Strawberry legacy graphql-ws retains naturally completed subscription slots

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphqlws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When...

CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107725 Hazelcast: Authorization bypass in IMap Predicates API

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107831 Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll,...

CVE-2026-107830 Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary...

CVE-2026-107829 Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks...

CVE-2026-107828 Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login

Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina sets the password to the first four digits of the Weibo I...

CVE-2026-107800 Jivejdon through 5.0 Stored XSS via Private Short Messages

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which...

CVE-2026-107801 Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share i...

CVE-2026-107799 Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in...

CVE-2026-107798 Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...

CVE-2026-107796 Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters

Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing...

CVE-2026-107797 Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters

Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string...