CVE-2026-68355

A flaw was found in the ath11k component of the Linux kernel. When processing Wi-Fi wireless fidelity data, a specific function can attempt to access memory outside of its allocated buffer. This buffer underflow occurs if the first entry in a data structure has a zero buffer address, leading to a...

CVE-2026-68315

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. When processing a Stream Reset Incoming Request RESETINREQUEST from a peer, the kernel does not properly validate the stream count. This can lead to an integer overflow when calculating the size for t...

CVE-2026-68239

A flaw was found in the Linux kernel's Direct Rendering Manager drm/ttm component. A local attacker could trigger a null pointer dereference by manipulating memory pages in ttmpoolbackup. This vulnerability occurs because the system attempts to process or free memory pages that are either empty...

CVE-2026-67288

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions. Mitigati...

CVE-2026-73153

A flaw was found in svxlink's EchoLink implementation. An out-of-bounds read in the RTCP/SDES packet handling allows a pre-authentication remote attacker to read beyond buffer boundaries via crafted UDP packets, potentially leading to information disclosure or a crash. Mitigation Update svxlink t...

CVE-2026-73154

A flaw was found in svxlink. A stack overflow in the StationData::setData function can be triggered by specially crafted input data, potentially allowing a remote attacker to crash the application or achieve arbitrary code execution. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73152

A flaw was found in svxlink's EchoLink proxy implementation. An integer truncation in message-length handling can result in incorrect buffer sizes, leading to potential memory corruption when processing specially crafted proxy messages. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73151

A flaw was found in svxlink's remotetrx NetUplink component. An unvalidated audio length field enables an out-of-bounds read, and when AUTHKEY is not set, transceiver control functions are exposed to unauthenticated remote access. This allows unauthorized control of radio hardware connected to th...

CVE-2026-73150

A flaw was found in svxlink's LocationInfo/APRS functionality. The updateQsoStatus function in AprsTcpClient.cpp formats a remote EchoLink station's callsign and info string into a fixed 80-byte stack buffer using sprintf without length checks. A remote attacker controlling an EchoLink station ca...

CVE-2026-73149

A flaw was found in svxlink's NetRx component. An unvalidated MsgAudio length field allows a remote attacker to trigger an out-of-bounds read beyond buffer boundaries, potentially leading to information disclosure or a crash. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73148

A flaw was found in svxlink's svxreflector component. A dangling Json::Value reference is written to after the underlying storage is replaced upon receiving repeated MsgNodeInfo messages. This use-after-free write can lead to a crash or potentially arbitrary code execution. Mitigation Update...

CVE-2026-73147

A flaw was found in svxlink's reflector client. The talkerstart and talkerstop event handlers directly concatenate a server-supplied talker callsign into TclEval commands without any sanitization or escaping. A malicious or compromised reflector server can supply a crafted callsign containing TCL...

CVE-2026-73146

A flaw was found in svxlink's svxreflector component. A reentrant client deletion triggered via a sendError write-failure path leads to a use-after-free on the client object. A remote attacker can trigger this condition to crash the reflector server or potentially achieve arbitrary code execution...

CVE-2026-73145

A flaw was found in svxlink's asynchronous HTTP server. No limits are enforced on incoming HTTP request-line or header sizes. A remote attacker can send excessively large requests to exhaust available memory, resulting in a denial of service. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73144

A flaw was found in svxlink's FRN module. A server-supplied list item count is accepted without validation, allowing a malicious server to trigger unbounded memory allocation. This can lead to memory exhaustion and a denial of service. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-73143

A flaw was found in svxlink's RtlTcp component. A malformed rtltcp greeting from a remote source triggers an unconditional exit1 call, causing the entire svxlink daemon to terminate. A remote attacker can exploit this to achieve a complete denial of service of the repeater controller. Mitigation...

CVE-2026-73142

A flaw was found in svxlink's remotetrx NetUplink component. When a server initiates a disconnect, the associated connection object is not properly freed, causing a memory leak. A remote attacker can repeatedly trigger disconnects to cause unbounded memory growth, leading to a denial of service...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-68426

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...

CVE-2026-68201

A flaw was found in the ALSA Advanced Linux Sound Architecture timer component of the Linux kernel. When a master timer instance is closed, it does not properly ensure that all associated slave timer callbacks have finished executing before detaching them. This oversight can lead to a...

CVE-2026-34191

A flaw was found in Apache Portable Runtime Utility. This vulnerability, known as SQL Injection, occurs in the aprdbdoracle provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-15562

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 or :9990, or :4447 and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service...

CVE-2026-15563

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

CVE-2026-15561

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15556

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...

CVE-2026-10579

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...

CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

CVE-2026-72693

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

CVE-2026-72694

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

CVE-2026-19519

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service. Mitigation Where possible, configur...

CVE-2026-41115

A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMERGROUPDESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists ACLs,...

CVE-2026-19391

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...

CVE-2026-57817

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

CVE-2026-67289

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol RDP server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled...

CVE-2026-68079

A flaw was found in Apache CXF's DefaultEncryptingCodeDataProvider. This vulnerability allows a remote attacker to redeem a captured authorization code an unlimited number of times. The flaw exists due to an issue in the removeCodeGrant functionality, which fails to properly invalidate used...

CVE-2026-57818

A flaw was found in Apache CXF. A race condition in the JCacheCodeDataProvider allows a remote attacker to redeem a single authorization code multiple times through concurrent requests. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized...

CVE-2026-24329

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

CVE-2026-24330

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

CVE-2026-66806

A flaw was found in console. When the HTTPSPROXY environment variable is not configured, the console component fails to verify Transport Layer Security TLS certificates for outbound connections. A network-positioned attacker Man-in-the-Middle can exploit this vulnerability to intercept the cluste...

CVE-2026-68083

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB server. An authenticated client could exploit a path resolution error, specifically in the ksmbdvfskernpathcreate function. This vulnerability allows a client to use ".." components in a path to escape the intended...

CVE-2026-19411

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader. Mitigation The code could be modified to include NULL pointer...

CVE-2026-46604

A flaw was found in the golang.org/x/image/tiff component. This vulnerability allows a remote attacker to cause a denial of service DoS by providing a specially crafted, invalid TIFF image. When the TIFF decoder attempts to process an image with an out-of-bounds strip offset, it can panic, leadin...

CVE-2026-18620

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-18618

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service DoS issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2...

CVE-2026-18611

A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB root/user passwords and MinIO access/secret keys, if they can access the MinIO Route or MariaDB Service. The flaw occurs because the...

CVE-2026-66805

A flaw was found in the console component. An attacker who can write to container logs on a managed cluster can inject malicious code into the hub console user's browser session. This occurs when the user views raw pod logs, as the console does not properly escape the log content. Successful...