CVE-2026-93402

A flaw was found in rsyslog. When using the imdtls input module configured for name or fingerprint authentication, permitted-peer identity checks are not enforced after a successful DTLS handshake. A remote attacker possessing a valid certificate signed by the listener's trusted Certificate...

CVE-2026-101333

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using...

CVE-2026-98130

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. A race condition exists when starting an SCTP timer, where the timer can expire before it is reset, resulting in improper reference counting for the connection association. An attacker could exploit this...

CVE-2026-93816

A flaw was found in the Linux kernel's Flash-Friendly File System F2FS. When converting inline directory entries into standard directory blocks, the kernel does not properly validate recorded filename lengths before copying them. A local user could exploit this flaw by mounting a specially crafte...

CVE-2026-93815

A flaw was found in the Linux kernel's Au1000 Ethernet driver. This vulnerability allows a privileged local user to cause a Denial of Service DoS when disabling or closing the network interface. The issue occurs because the driver executes a sleepable interrupt cleanup routine while holding an...

CVE-2026-93284

A flaw was found in the Linux kernel's DRM Direct Rendering Manager pagemap subsystem. During page migration error handling, the kernel clears the page tracking array before finishing Direct Memory Access DMA unmapping operations. A local user could exploit this flaw by triggering migration...

CVE-2026-93283

A flaw was found in the Linux kernel's I3C Improved Inter-Integrated Circuit master subsystem. This issue can result in a Denial of Service DoS caused by a system crash. When device registration fails, the driver frees the device object but fails to clear internal pointers referencing the freed...

CVE-2026-91769

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...

CVE-2026-93817

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

CVE-2026-98127

A flaw was found in the Linux kernel's SMB client. The smb3insertrange function does not properly validate the resulting file size when inserting a range of space into an existing file on a mounted share. A local user can exploit this flaw using a fallocate request to bypass configured file size...

CVE-2026-98126

A flaw was found in the Linux kernel's SMB client. This flaw allows a local user to bypass enforced file-size restrictions and expand files beyond authorized limits. When handling file allocation operations that zero out a range of data without preserving the file's existing size, the kernel fail...

CVE-2026-98125

A flaw was found in the Linux kernel's Server Message Block SMB client. This flaw allows a local user to read stale or inconsistent file data from a mounted network share. When modifying file ranges using insert or collapse operations, offsets that are not aligned with memory page boundaries fail...

CVE-2026-93814

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI subsystem. When a system suspend is initiated while an SPI controller operating in target mode has an active data transfer, the ongoing transfer is not cleanly aborted. This issue allows a local user to cause a Denial of Servi...

CVE-2026-93813

A flaw was found in the Linux kernel's Btrfs file system. The file system validation mechanism fails to properly verify file name lengths in file reference entries, leading to an out-of-bounds memory access when processing corrupted data. A local attacker can exploit this issue by mounting or...

CVE-2026-93282

A flaw was found in the Linux kernel's ksmbd server. This flaw allows an authenticated remote user to bypass access controls and gain unauthorized file access. When calculating maximal access permissions, ksmbd improperly combines rights from every Access Control Entry ACE regardless of whether t...

CVE-2026-93281

A flaw was found in the Linux kernel's Realtek Wi-Fi driver rtw89. This vulnerability may allow an attacker within wireless range to cause a Denial of Service DoS via a system crash. By transmitting a crafted wireless frame with malformed capability information, an attacker can trigger an imprope...

CVE-2026-74765

A flaw was found in Net::IDN::Punycode. An integer overflow vulnerability in the encodepunycode function, specifically within the XS backend, allows a remote attacker to cause an out-of-bounds read. By supplying a specially crafted string, an attacker can trigger the overflow, leading to either t...

CVE-2026-98124

A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When file modification operations such as fallocate range requests are performed on a mounted network share, the system fails to invalidate the local file system cache FS-Cache. This flaw allows a local user to read...

CVE-2026-100694

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

CVE-2026-100691

A flaw was found in Hugo. The syntax highlighter fails to properly sanitize the lineAnchors option, resulting in a stored Cross-Site Scripting XSS vulnerability. A remote attacker capable of submitting Markdown content can exploit this by supplying a crafted lineAnchors code block attribute. When...

CVE-2026-100690

A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a...

CVE-2026-98123

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker can cause a Denial of Service DoS by sending a specially crafted network packet during an active SCTP connection. A discrepancy in how parameter padding is processed causes the syste...

CVE-2026-98122

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN driver. A local unprivileged attacker can cause a denial of service DoS or potentially escalate privileges through memory corruption. This vulnerability occurs because the Multicast Database MDB subsystem improperly validates...

CVE-2026-93812

A flaw was found in the Linux kernel's ksmbd Server Message Block server. A remote attacker could cause a denial of service DoS by triggering a kernel memory leak during security attribute operations. When an error occurs while encoding security descriptors, dynamically allocated memory is not...

CVE-2026-93811

A flaw was found in the Linux kernel's ksmbd Server Message Block SMB server. When processing access control list ACL data, error-handling routines fail to release memory buffers if decoding fails or if an invalid security descriptor size is encountered. A remote attacker could exploit this...

CVE-2026-93280

A flaw was found in the Linux kernel's Greybus audio subsystem. An attacker connecting a malicious Greybus device can trigger a Denial of Service DoS or unauthorized information disclosure by providing a crafted audio topology descriptor. Because the driver fails to verify that internal section...

CVE-2026-93279

A flaw was found in the Linux kernel's Octeon network driver. During network device shutdown or driver removal, a pending cleanup task may execute after associated network device structures have already been freed from memory. A local user could exploit this race condition during device teardown ...

CVE-2026-19444

A flaw was found in Kubernetes kubectl. An attacker controlling a container can write arbitrary files to the host system when a user copies files from the container. Because the tool does not properly validate file paths when extracting archives on Windows, a malicious container can traverse...

CVE-2026-98120

A flaw was found in the Linux kernel's netfs network filesystem subsystem. A local user can cause a Denial of Service DoS by initiating specific unbuffered write operations on an affected filesystem. When a write subrequest encounters zero-length data during preparation, the kernel fails to relea...

CVE-2026-98121

A flaw was found in the Linux kernel's Mstar MSC313e watchdog driver. The driver fails to properly set platform device data during device initialization. Consequently, when system power management routines attempt to access this data during suspend or resume operations, a NULL pointer dereference...

CVE-2026-93809

A flaw was found in the Linux kernel's AMD GPU driver amdgpu. A local user with administrative privileges could cause a Denial of Service DoS by unloading the driver module while callbacks are still scheduled. Because the driver does not wait for pending Read-Copy Update RCU callbacks to complete...

CVE-2026-93278

A flaw was found in the Linux kernel's Octeon network driver. During interface shutdown, the driver deletes the packet polling mechanism without properly disabling it first, allowing active polling routines to continue running after interrupt handlers are released. A local attacker could exploit...

CVE-2026-93277

A flaw was found in the Linux kernel's Broadcom NetXtreme-E Remote Direct Memory Access RDMA driver bnxtre. During resource teardown, internal driver resources are released before userspace data access is validated. If userspace memory access fails during this operation, the kernel preserves the...

CVE-2026-93276

A flaw was found in the Linux kernel's Renesas R-Car USB 2.0 PHY driver. A local user could cause a denial of service DoS by unbinding or removing the affected device. Because the driver fails to properly register a power regulator cleanup routine during initialization, device removal leaves the...

CVE-2026-93275

A flaw was found in the Linux kernel's Intel Processor Trace PT subsystem. A local user could trigger a Denial of Service DoS condition by executing performance monitoring operations that cause group event throttling. Due to improper state tracking during event start and stop operations, the...

CVE-2026-93274

A flaw was found in the Linux kernel's Broadcom BCM2835 pin control driver. During device initialization, if pin controller registration fails, the driver attempts to remove an unregistered General Purpose Input/Output GPIO chip. This improper error handling leads to a null pointer dereference,...

CVE-2026-98119

A flaw was found in the Linux kernel's netfs network filesystem subsystem. A local user could cause a Denial of Service DoS by triggering a system crash when performing unbuffered write operations under memory exhaustion conditions. This issue occurs because the kernel fails to verify that memory...

CVE-2026-98118

A flaw was found in the Linux kernel's netfs network filesystem subsystem. A local user could exploit a race condition during readahead operations to cause a Denial of Service DoS via a system crash. This issue stems from improper synchronization between the application thread and collector threa...

CVE-2026-98117

A flaw was found in the Linux kernel's cachefiles subsystem. When processing cache coherency trace events, the system reads fixed-size data from a buffer that may be empty or shorter than expected. A local user could exploit this flaw to trigger an out-of-bounds memory read, resulting in a system...

CVE-2026-93808

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture caiaq USB audio driver. When processing endpoint reply messages, the driver fails to validate the length of received USB data buffers before reading fixed offsets. A physically present attacker connecting a crafted USB...

CVE-2026-93807

A flaw was found in the Linux kernel's Redpine Signals RSI Wi-Fi driver. An attacker can trigger a Denial of Service DoS or information disclosure by configuring wireless encryption keys for ciphers with shorter key lengths than the Temporal Key Integrity Protocol TKIP. The driver unconditionally...

CVE-2026-93806

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. An attacker within Wi-Fi range could cause a Denial of Service DoS by sending a truncated association response frame. The wireless component accesses status and information fields before verifying that the received management fra...

CVE-2026-82331

A flaw was found in the tar source plugin of Apache BuildStream. This improper link resolution vulnerability, also known as 'link following', allows a remote attacker to write arbitrary files on the host system. By crafting malicious source tarballs containing symlinks, an attacker can exploit th...

CVE-2025-14181

A flaw was found in PHP. A malicious server can cause a Denial of Service DoS by exploiting an improper buffer size check in the Simple Object Access Protocol SOAP client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer...

CVE-2026-98116

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sound subsystem. A race condition between concurrent memory mapping operations and audio buffer reallocations allows memory pages to be released while still mapped as writable. A local user can exploit this vulnerabilit...

CVE-2026-98115

A flaw was found in the Linux kernel's ksmbd Server Message Block subsystem, which may lead to a Denial of Service DoS. When terminating multichannel SMB connections, the server fails to properly synchronize and wait for all communication channels to finish before freeing shared session resources...

CVE-2026-93805

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. The kernel fails to properly validate the length of wireless management frames before accessing subtype-specific data fields. An attacker within wireless range could exploit this flaw by transmitting malformed, truncated manageme...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-98114

A flaw was found in the Linux kernel's ksmbd server. The Discretionary Access Control List DACL parsing logic silently ignores errors caused by truncated access control entries and memory allocation failures, allowing the system to continue with an incomplete permission conversion. A remote...

CVE-2026-93273

A flaw was found in the Linux kernel's TPS6594 regulator driver. When configuring multi-phase regulators during device initialization, the driver fails to verify whether a device node exists before accessing it and fails to properly release acquired node references. A local attacker could exploit...