CVE-2026-98936

A flaw was found in the Linux kernel's ath11k wireless driver. During hardware restart events, the driver fails to properly reset its connected station counter. Consequently, the driver falsely reports that the connection capacity has been exceeded, resulting in a Denial of Service DoS where new...

CVE-2026-98925

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter sockmap subsystem. This flaw allows a local attacker to cause a Denial of Service DoS when redirecting network traffic back to the originating socket. The kernel improperly double-counts sequence numbers for received TCP Transmissi...

CVE-2026-98917

A flaw was found in the Linux kernel's PA-RISC architecture support. This vulnerability can lead to a Denial of Service DoS when deep call chains cause a kernel stack overflow on 64-bit systems. A local user executing complex or resource-intensive workloads can trigger this condition, causing the...

CVE-2026-98985

A flaw was found in the Linux kernel. A local user can exploit a use-after-free vulnerability by invoking the pivotroot system call with a file descriptor referencing an unmounted filesystem whose parent mount has already been freed. This flaw allows the kernel to access previously released memor...

CVE-2026-98986

A flaw was found in the Linux kernel's mount namespace subsystem. When cleaning up a mount namespace associated with filesystem notification marks, the kernel improperly attempts to acquire a sleeping lock within an invalid interrupt context. A local user with privileges to manage mount namespace...

CVE-2026-98930

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for the s390 architecture. A local user with access to the KVM interface can trigger a Denial of Service DoS by injecting a stop and store status signal into an already stopped virtual CPU vCPU. In this scenario, th...

CVE-2026-98934

A flaw was found in the Linux kernel's IPv6 Segment Routing SRv6 subsystem. This vulnerability can lead to a Denial of Service DoS when the kernel processes certain encapsulated packets—such as discovery traffic lacking socket or device associations—while segment routing flow labeling is enabled...

CVE-2026-98923

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by triggering an unexpected kernel warning on ARM64 systems. By establishing a restricted memory mapping and reading process details through the /proc interface, the kernel incorrectly flags valid user protection...

CVE-2026-98926

A flaw was found in the Linux kernel's AMD display driver. During Display Power Management Signaling DPMS sequences, the driver attempts to access a display sink pointer without verifying whether it is null. A local user could exploit this flaw during display power state transitions, triggering a...

CVE-2026-98931

A flaw was found in the Linux kernel's Memory Technology Device MTD SPI-NAND driver. When probing a flash memory device configured without an Error Correction Code ECC engine, the driver attempts to access an uninitialized pointer. A local user could exploit this flaw to crash the system, resulti...

CVE-2026-98921

A flaw was found in the Linux kernel's OverlayFS subsystem. When debug logging is enabled, a directory creation operation can trigger a use-after-free condition by referencing a directory entry that has already been released by the virtual file system. A local user could exploit this flaw to cras...

CVE-2026-98942

A flaw was found in the Linux kernel's schedext extensible scheduler subsystem. Due to a race condition, internal core-ID mapping tables were exposed before being fully initialized and were modified without adequate synchronization. A local attacker could exploit this timing issue during schedule...

CVE-2026-118773

A flaw was found in glob, which can lead to a Denial of Service DoS. When an application attempts to cancel an active file search or encounters a timeout, the library fails to properly halt execution and continues scanning directories in the background. A remote attacker can exploit this issue by...

CVE-2026-119272

An out of bounds read flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/569012543...

CVE-2026-119189

A flaw was found in node-forge. The certificate verification mechanism fails to enforce path length constraints on Certificate Authority CA certificates that lack a key usage extension. A remote attacker with control of a subordinate certificate can exploit this flaw by presenting a certificate...

CVE-2026-118778

A flaw was found in node-forge. The Transport Layer Security TLS client improperly validates whether a server certificate was provided during the handshake. A malicious server or an on-path attacker can exploit this flaw by omitting the certificate message, triggering an uncaught exception that...

CVE-2026-119208

A flaw was found in pypdf. An attacker can cause a Denial of Service DoS by providing a crafted, encrypted PDF document containing a forged page count. When an application attempts to retrieve the page count, pypdf trusts the unvalidated declared value rather than verifying the page tree, resulti...

CVE-2026-119284

A flaw was found in joserfc. A remote attacker can trigger a Denial of Service DoS by submitting specially crafted compact JSON Web Signature JWS tokens that exhaust process memory. The library parses and splits input bytes into individual segments before enforcing aggregate size limits, causing...

CVE-2026-119207

A flaw was found in pypdf. It can lead to a Denial of Service DoS through excessive memory consumption when processing a crafted, invalid PDF dictionary in strict mode. In this scenario, nested parsing errors repeatedly append text to new exceptions, amplifying the error message size. A remote...

CVE-2026-119205

A flaw was found in pypdf. When cloning or duplicating dictionary objects, the library improperly tracks visited objects, allowing cyclic structures to bypass loop detection. A remote attacker could exploit this vulnerability by providing a specially crafted PDF document containing circular...

CVE-2026-118257

A flaw was found in vue-i18n. The HTML sanitization mechanism fails to properly neutralize inline frame iframe srcdoc attributes when processing translated content. A remote attacker could exploit this vulnerability by injecting malicious parameters or translation data into applications configure...

CVE-2026-119209

A flaw was found in pypdf. This vulnerability allows a remote attacker to cause a Denial of Service DoS by convincing an application or user to open a specially crafted PDF document. When processed, malicious cross-reference streams force the library to allocate excessive amounts of memory,...

CVE-2026-119206

A flaw was found in pypdf. A remote attacker can cause a Denial of Service DoS by providing a crafted PDF document containing numerous page label ranges. When processing page labels, the library repeatedly scans the document's label data for each page, leading to excessive processing time and...

CVE-2026-119134

A flaw was found in Wasmtime. This vulnerability allows a malicious guest to cause a Denial of Service DoS by exhausting host system memory. The issue occurs because component-model resource handle tables only enforce limits per component instance rather than accounting for allocations across...

CVE-2026-119203

A flaw was found in pypdf. This vulnerability allows an attacker to cause a Denial of Service DoS by tricking a user or application into processing a specially crafted PDF document. When the library parses an incomplete file where the cross-reference table ends without a trailer, the parser...

CVE-2026-119204

A flaw was found in pypdf. A remote attacker could exploit this vulnerability by enticing a user or automated processing service to open a crafted PDF file containing shared page resources. When parsing the document's page tree structure, the library copies inherited resource entries without an...

CVE-2026-119138

A flaw was found in Wasmtime. This vulnerability allows an attacker providing misbehaving guest code to cause a Denial of Service DoS. By inducing an execution trap that leaves the internal runtime storage in an inconsistent state, pending calls trigger an assertion failure. This failure causes t...

CVE-2026-119142

A flaw was found in Wasmtime. This issue allows a Denial of Service DoS condition where the host application crashes when canceling pending asynchronous tasks. When an embedder drops or cancels an asynchronous function call before execution begins, cleanup routines fail to handle the missing work...

CVE-2026-118765

A flaw was found in Botan. When its automatic random number generator RNG is queried with an empty buffer while unseeded, it can improperly mark itself as seeded without gathering entropy from a secure source. On configurations lacking system RNG support, the generator falls back on predictable...

CVE-2026-117985

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Graphics component...

CVE-2026-117980

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics component...

CVE-2026-117973

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Networking: DNS component...

CVE-2026-118667

A flaw was found in LangGraph. Helper functions responsible for streaming operations fail to properly sanitize caller-controlled identifiers before inserting them into authenticated request paths. An attacker can supply path traversal sequences within these identifiers to redirect requests to...

CVE-2026-116796

A flaw was found in Highcharts. An attacker who can supply chart text configurations can execute arbitrary script in a victim's browser session. The library fails to validate URL schemes on certain Scalable Vector Graphics SVG anchor link attributes, allowing malicious JavaScript links to persist...

CVE-2026-119137

A flaw was found in Wasmtime. A guest WebAssembly module can cause a Denial of Service DoS by crashing the host system through a stack overflow. By defining a long chain of recursive types, releasing the top-level type triggers unbounded recursive cleanup operations that exhaust host stack memory...

CVE-2026-118767

A flaw was found in Botan. Its Python bindings fail to properly reject embedded null characters when converting strings, causing bcrypt password hashing functions to truncate the input at the null byte. A remote attacker can exploit this flaw to bypass password length and complexity policies, as ...

CVE-2026-118768

A flaw was found in botan. The command-line utility fails to verify the cryptographic signature and authorization of Online Certificate Status Protocol OCSP responses. An on-path network attacker or malicious responder can exploit this vulnerability by returning a forged response with an invalid...

CVE-2026-119141

A flaw was found in Wasmtime. A malicious WebAssembly Wasm module can cause a Denial of Service DoS by crashing the host runtime. This issue occurs because an internal execution flag is not properly cleared during memory reallocation realloc, allowing the guest module to unexpectedly call into ho...

CVE-2026-118766

A flaw was found in Botan. Its Online Certificate Status Protocol OCSP client improperly follows HTTP redirects when sending certificate validation requests. A malicious responder or network attacker can exploit this issue to redirect the client into making a blind request to an otherwise...

CVE-2026-118673

A flaw was found in KeePassXC. A local user with access to the inter-process communication IPC interface and an authorized database association can cause a Denial of Service DoS by crashing the application. By prompting an unlocked database to generate and encrypt an excessively large response...

CVE-2026-118660

A flaw was found in happy-dom. By default, external resources such as inline frame iframe sources and stylesheets are automatically fetched when parsing HTML documents on the server. A remote attacker who supplies untrusted HTML can trigger Server-Side Request Forgery SSRF, forcing the applicatio...

CVE-2026-115455

A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a...

CVE-2026-114691

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector std::vector constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to...

CVE-2026-114690

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the...

CVE-2026-42057

A flaw was found in VTK. An attacker can cause a Denial of Service DoS by supplying a specially crafted PNG image file. When processed by the PNG reader component, the malformed input triggers an invalid pointer dereference, causing the application to crash...

CVE-2026-119140

A flaw was found in Wasmtime. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the host application embedding the runtime. By supplying a crafted WebAssembly component whose start function executes an asynchronous call followed by a thread yield, the runtime fail...

CVE-2026-119143

A flaw was found in Wasmtime. Untrusted WebAssembly guest code can trigger a Denial of Service DoS by executing zero-length stream read or write operations with unvalidated memory addresses. This improper validation causes the host runtime to panic and unexpectedly terminate, crashing the host...

CVE-2026-119139

A flaw was found in Wasmtime. An attacker who supplies a crafted WebAssembly component can cause a Denial of Service DoS by crashing the host application. This issue occurs because an internal assertion fails when the host invokes an exported guest function configured with asynchronous Applicatio...

CVE-2026-119136

A flaw was found in Wasmtime. Insufficient validation occurs in the Store component when mixing asynchronous and synchronous WebAssembly function calls. When an application re-enters WebAssembly through synchronous interfaces from an asynchronous host function, an attacker could trigger a runtime...

CVE-2026-119135

A flaw was found in Wasmtime. This vulnerability allows a guest WebAssembly module to cause a Denial of Service DoS by crashing the host application. When the host reads a component model stream that uses a mismatched internal data type, an assertion failure triggers an unhandled panic instead of...