CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

CVE-2026-90423: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxeodpmrinituser stores &umemodp-umem in mr-umem before calling rxeodpinitpages. If rxeodpinitpages fails, rxeodpmrinituser releases umemodp and returns an error. rxeregusermr the...

CVE-2026-90421: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as removeidstore can free the node. Thus, make a copy in pcimatchdevice. Also, clarify that the id...

CVE-2026-90407: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix overreads in ath11kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-54495: Exposure of Resource to Wrong Sphere

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

CVE-2026-50125: Uncontrolled Resource Consumption

MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated getresource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource...

CVE-2026-92230: Missing Release of Memory after Effective Lifetime

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle...

CVE-2026-90997: Authentication Bypass by Capture-replay

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-55061: Improper Neutralization of Argument Delimiters in a Command

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-54617: Improper Limitation of a Pathname to a Restricted Directory

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in...

CVE-2026-54451: Uncontrolled Recursion

Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. In lib/protobuf/decoder.ex,...

CVE-2026-54239: Insufficient Verification of Data Authenticity

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...

CVE-2026-52851: Improper Neutralization of Special Elements used in an SQL Command

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. PermissionLinkedHashMap in...

CVE-2026-49292: Missing Authorization

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...

CVE-2026-47252: Improper Control of Generation of Code

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

CVE-2026-19477: Stack-based Buffer Overflow

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux uldaq. This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux uldaq v1.2.1 and prior versions...

CVE-2026-89038: Improper Limitation of a Pathname to a Restricted Directory

Verizon Cloud for Android com.vcast.mediamanager before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted displayname value containing path-traversal...

CVE-2026-54676: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-44236: Heap-based Buffer Overflow

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...

CVE-2026-93155: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

CVE-2026-93154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

CVE-2026-93152: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Use acquire/release for queue enabled state applenvmeinitqueue initializes queue state and then marks the queue enabled. The interrupt and request paths check enabled before using that queue state. The old wmb after...

CVE-2026-93151: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93148: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

CVE-2026-93142: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

CVE-2026-93139: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

CVE-2026-93134: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: printk: Fix possible console use-after-free When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock...

CVE-2026-93131: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-privacy: Fix race condition Accessing priv-featurespresent needs to happen with the list mutex being held, otherwise priv can be freed at any moment...

CVE-2026-93126: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcomq6v5adsp: Fix reference leak for device node When calling ofparsephandlewithargs, the caller is responsible to call ofnodeput to release the reference of device node. In adspmapcarveout, it does not release the...

CVE-2026-93125: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

CVE-2026-93121: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix fence cleanup in ffsdmabuftransfer error paths The error paths for endpoint-disabled ESHUTDOWN and request-allocation failure ENOMEM in ffsdmabuftransfer jump to errfenceput which calls dmafenceput on the...

CVE-2026-93120: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: fix out-of-bounds read of qwsign osdescqwsignshow passes OSSTRINGQWSIGNLEN as the input length to utf16stoutf8s, but that argument counts UTF-16 code units while OSSTRINGQWSIGNLEN 14 is the byte size of...

CVE-2026-93204: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadvdatentryadd, it is done using a simple copy function. A parallel reader might only see parts of this update. In worst case, the reader is...

CVE-2026-93197: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvecreparentlru splices the child's lists into the parent's and credits the pare...

CVE-2026-93195: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel The DisplayPort AUX channel gets initialized and registered during dwdpbind, but it is never unregistered, which may lead to resource leaks and/or use-after-free...

CVE-2026-93193: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Fix OF node reference leak via auto cleanup Sashiko reported a reference leak in rockchipdpdrmencoderenable, the ofgetchildbyname function does not call ofnodeput in a symmetrical way 1. Fix the device...

CVE-2026-93191: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smack: fix incorrect task context in smackmsgqueuemsgrcv The smackmsgqueuemsgrcv function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd syscall path, if a receiver is already...

CVE-2026-93188: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index konekeepvaluesuptodate and koneprofileactivated use an 8-bit, device-supplied profile value as an index into the 5-element kone-profiles array without a range check. A malicious US...

CVE-2026-93186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

CVE-2026-93182: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

CVE-2026-93177: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

CVE-2026-93172: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: handle allocpercpu failure in freeareainitcorehotplug We miss a failed allocation check for pgdat-percpunodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and...

CVE-2026-93163: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rnglist 4. May try to set rng to...

CVE-2026-93160: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmelecdhcomputesharedsecret uses the private key stored in the device. However, the public key is cached only after atmelecdhsetsecret...

CVE-2026-93159: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

CVE-2026-57846: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-54716: Allocation of Resources Without Limits or Throttling

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54692: Incorrect Calculation of Buffer Size

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...

CVE-2026-54627: Heap-based Buffer Overflow

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psdprivatesailpixelformat in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAILPIXELFORMATBPP1INDEXED without requiring...