CVE-2026-99065

A flaw was found in the Linux kernel's cpuset subsystem. A race condition during CPU hotplug offline operations can leave the root control group with no active processors before CPU masks are updated, resulting in a null pointer dereference. A privileged local user or process initiating CPU...

CVE-2026-99061

A flaw was found in the Linux kernel's brcmfmac wireless driver. This vulnerability can lead to a Denial of Service DoS caused by a race condition during the removal of peer-to-peer P2P device interfaces. A local user could trigger this flaw by unloading the driver while the user space process...

CVE-2026-99060

A flaw was found in the Linux kernel's MediaTek MT7603 wireless driver. A local user with network privileges can cause a denial of service DoS by transmitting raw frames through a monitor interface. Because the driver publishes its global station tracking structure without proper initialization,...

CVE-2026-99058

A flaw was found in the Linux kernel's workqueue subsystem. A local user can cause a Denial of Service DoS through a system crash by queueing work onto a workqueue that is being drained or destroyed. This issue occurs because the kernel fails to verify that a worker thread is actively executing...

CVE-2026-99055

A flaw was found in the Linux kernel's TCP networking subsystem. When handling zero-copy data reception involving certain device memory buffers, the kernel fails to properly validate memory fragment types before dereferencing them, resulting in a null pointer dereference. An attacker sending...

CVE-2026-99054

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication subsystem. A local user could exploit this flaw to cause a Denial of Service DoS or potential memory corruption. The vulnerability arises from a race condition during topology server shutdown, where connections ar...

CVE-2026-99053

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC subsystem. This flaw allows a local user to cause a denial of service DoS or potentially escalate privileges on the system. The issue occurs because link configuration handlers release read locks without properly...

CVE-2026-99052

A flaw was found in the Linux kernel. When a Network File System version 4 NFSv4 share configured with security labels is mounted multiple times, the Security-Enhanced Linux SELinux subsystem fails to preserve native labeling flags on the reused filesystem. This flaw allows a local user to silent...

CVE-2026-99051

A flaw was found in the Linux kernel's fsverity subsystem. A lack of proper synchronization when removing file verification structures allows concurrent lookup operations to access memory after it has been freed. A local user could exploit this vulnerability by triggering simultaneous file...

CVE-2026-116802

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting XSS. When configured to parse Extensible Hypertext Markup Language XHTML content, the library fails to properly normalize and sanitize attribute names within animation elements. An attacker...

CVE-2026-116732

A flaw was found in libdwarf. When parsing debug address tables, the library fails to properly account for starting offsets when verifying section length boundaries. An attacker could exploit this vulnerability by tricking a user or automated system into parsing a specially crafted object file,...

CVE-2026-116741

A flaw was found in speex. An out-of-bounds write vulnerability exists due to improper buffer length handling when decoding byte streams into external memory buffers. A remote attacker could exploit this flaw by streaming specially crafted audio data into an affected application, triggering memor...

CVE-2026-116671

A flaw was found in Xpdf. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted JPEG 2000 image. Due to improper validation of the progression order field, processing the file triggers an infinite loop that causes the application to hang. Mitigati...

CVE-2026-99050

A flaw was found in the Linux kernel's Multi-Protocol Synchronous Serial Engine MPSSE GPIO driver. A race condition occurs when enabling interrupt polling while disconnecting a device, allowing scheduled background work to run after the underlying device memory has been released. A local attacker...

CVE-2026-116804

A flaw was found in DOMPurify. When configured to sanitize content for template engines, DOMPurify fails to properly scrub template expressions within attached shadow roots. A remote attacker can exploit this flaw by supplying crafted markup with expressions split across disallowed elements, whic...

CVE-2026-116803

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to conduct cross-site scripting XSS attacks by supplying specially crafted markup. When an application processes content using in-place sanitization hooks that remove surrounding elements, the library fails to neutralize...

CVE-2026-116740

A flaw was found in libcss. A remote attacker could cause a Denial of Service DoS by convincing an application or user to parse a specially crafted stylesheet. When the library processes a media query list ending with a trailing comma, an unhandled null pointer dereference occurs, causing the...

CVE-2026-116731

A flaw was found in Furnace. The application does not properly validate subsong indices when parsing FamiTracker module files, leading to an out-of-bounds write. By convincing a user to open a specially crafted file, an attacker can corrupt memory and cause the application to crash, resulting in ...

CVE-2026-116589

A flaw was found in ddtrace. This issue allows a remote attacker to cause a denial of service DoS when Interactive Application Security Testing IAST is enabled. Specifically, the string-processing instrumentation fails to handle internal errors during old-style string formatting operations. By...

CVE-2026-116730

A flaw was found in Furnace. This vulnerability allows an attacker to cause a Denial of Service DoS by convincing a user to open a specially crafted FamiTracker module file. The application fails to properly validate instrument note counts during file import, resulting in an out-of-bounds read th...

CVE-2026-116583

A flaw was found in seroval. A remote attacker could achieve arbitrary code execution in an application or web page that processes serialized data. When an application serializes a typed array containing untrusted properties, seroval improperly derives constructor names from attacker-controlled...

CVE-2026-116582

A flaw was found in seroval. This vulnerability allows a remote attacker to conduct cross-site scripting XSS attacks by supplying crafted regular expression input to an application that serializes and embeds it into an HTML script element. Because the library fails to properly escape regular...

CVE-2026-116579

A flaw was found in autobahn. An unauthenticated remote attacker can exploit this vulnerability by sending a small, highly compressed WebSocket message to a server configured with Brotli compression. Because decompression occurs without enforcing an output size limit during processing, the payloa...

CVE-2026-116578

A flaw was found in Tornado. When an application configures RedirectHandler with dynamic URL templates, user-controlled input in request paths can alter the target redirect scheme or host location. A remote attacker can exploit this vulnerability by sending a crafted request to trigger an open...

CVE-2026-116577

A flaw was found in Tornado. An unauthenticated remote attacker can cause a Denial of Service DoS by sending crafted HTTP requests containing many folded header continuation lines. Processing these lines requires quadratic computational effort, consuming excessive CPU resources on the server's...

CVE-2026-115927

A flaw was found in Tornado. When decoding HTTP/1.1 chunked transfer encoding, Tornado processes received data without yielding control back to the event loop. A remote unauthenticated attacker can send requests containing a large volume of small chunks to monopolize the process and consume...

CVE-2026-99064

A flaw was found in the Linux kernel. When removing Commercial IP Security Option CIPSO attributes from a network packet, the kernel does not adjust the cached offsets of subsequent IP options. A remote attacker could exploit this vulnerability by sending specially crafted IPv4 packets, causing t...

CVE-2026-116486

A flaw was found in Objenesis. The library caches object instantiators using only the class name rather than the unique class identity across separate class loaders. A local attacker can exploit this behavior in shared caching environments with identically named classes to induce type confusion...

CVE-2026-115919

A flaw was found in ONNX. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted machine learning model with malformed neural network nodes. During the shape inference process, the application attempts to read memory outside the intended boundaries...

CVE-2026-115922

A flaw was found in ONNX. This vulnerability allows an attacker to cause a Denial of Service DoS through excessive memory consumption by providing a specially crafted machine learning model. The issue occurs because tensor materialization routines resize memory arrays based on dimensions declared...

CVE-2026-115921

A flaw was found in Open Neural Network Exchange ONNX. When performing shape inference on a machine learning model, the Scan operator does not safely validate the required numscaninputs attribute. An attacker can exploit this issue by supplying an untrusted model that omits this attribute or...

CVE-2026-115920

A flaw was found in ONNX. When processing a crafted machine learning model containing a transpose convolution ConvTranspose operator with an undersized weight tensor, an out-of-bounds read occurs during dimension calculation. An attacker can exploit this issue by supplying a malicious model to an...

CVE-2026-109942

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop RD Gateway server can trigger a Denial of Service DoS by sending a specially crafted close-channel packet lacking payload data. The client fails to validate the missing payload before processing, causing the FreeRDP applicatio...

CVE-2026-104596

A flaw was found in libosmocore. An out-of-bounds read vulnerability in the Global System for Mobile Communications GSM 04.80 supplementary-service parser allows for information disclosure. A remote attacker can exploit this flaw by sending specially crafted messages, enabling them to read memory...

CVE-2026-115918

A flaw was found in vLLM. This vulnerability allows an authenticated remote attacker to cause a Denial of Service DoS by submitting a request containing an untrusted chat template to the responses endpoint. When no server template is configured, the application fails to enforce template trust...

CVE-2026-115916

A flaw was found in vLLM. This vulnerability allows a remote attacker to cause a Denial of Service DoS by submitting a request containing an out-of-bounds pre-tokenized prompt token identifier. Due to an off-by-one error in input validation, an invalid token identifier equal to the vocabulary siz...

CVE-2026-115914

A flaw was found in vLLM when processing image inputs with certain optical character recognition OCR models. A remote attacker can trigger a denial of service DoS by submitting a specially crafted image whose normalized pixel values sum to zero. This input causes the multimodal encoder validation...

CVE-2026-104597

A flaw was found in libosmocore. An out-of-bounds read vulnerability in the iuuprxinitialization function allows a remote attacker to obtain sensitive data. By sending specially crafted initialization network packets, an attacker can cause the application to read memory past the allocated buffer,...

CVE-2026-104594

A flaw was found in libosmocore. This issue allows a remote attacker to cause information disclosure via an out-of-bounds read vulnerability in the IPA CCM Connection and Carrier Management identity-tag parser. By sending specially crafted network messages, an attacker can trigger out-of-bounds...

CVE-2026-99087

A flaw was found in the Linux kernel's device-mapper integrity dm-integrity subsystem. A local user with administrative privileges can cause a Denial of Service DoS by activating a storage device in read-only mode when dirty journal bitmap flags are set. This issue occurs because the driver...

CVE-2026-98911

A flaw was found in the Linux kernel's dpaa2-switch network driver. When an error occurs during frame reception, the driver improperly invokes a cleanup routine intended for transmit buffers that expects a valid socket buffer structure. An attacker capable of sending traffic that triggers an erro...

CVE-2026-99086

A flaw was found in the Linux kernel's dm-integrity subsystem. When resuming a suspended integrity device, the kernel re-reads the storage metadata superblock without verifying that its layout matches the initial configuration. A local attacker with access to the underlying storage device could...

CVE-2026-98907

A flaw was found in the Linux kernel's Btrfs file system. A race condition exists in the sbwritepointer function due to missing locking synchronization when reading superblock metadata from the cache while block size settings are concurrently modified. A local user could exploit this flaw to caus...

CVE-2026-98905

A flaw was found in the Linux kernel's AMD GPU driver. This vulnerability allows a local user to cause a denial of service DoS and crash the system during Checkpoint/Restore In Userspace CRIU operations. The issue occurs because the driver fails to properly acquire and initialize queue buffers wh...

CVE-2026-99085

A flaw was found in the Linux kernel's extensible scheduler schedext. When a central processing unit CPU is taken offline while tasks remain managed by the scheduler, the inactive CPU stops dispatching those tasks, preventing the shutdown thread from finishing. A local attacker could exploit this...

CVE-2026-98906

A flaw was found in the Linux kernel's LAN966x network driver. When an attempt to reconfigure the Maximum Transmission Unit MTU fails, the driver does not properly restore its receive buffer settings. This inconsistency causes subsequent packet processing routines to assume larger buffer sizes th...

CVE-2026-116620

A flaw was found in rapidjson. A remote attacker can exploit an out-of-bounds read vulnerability in the regular expression regex parser by providing specially crafted input. This issue primarily leads to a Denial of Service DoS by causing the application to crash, and may also result in the...

CVE-2026-115911

A flaw was found in vLLM. An authenticated remote attacker or a malicious model repository can cause a Denial of Service DoS by providing a specially crafted chat template. Because templates are rendered without execution timeouts or resource limits, processing the input can permanently block...

CVE-2026-115910

A flaw was found in social-auth-core. The OpenID Connect authentication backend stores nonces single-use security tokens used to prevent replay attacks in a shared table without binding them to the initiating browser session and authentication state. A remote attacker who obtains a victim's unuse...

CVE-2026-109949

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can uncover a user's smartcard Personal Identification Number PIN through unrestricted brute-force authentication attempts. Because the virtual smartcard component resets the retry counter on each new connection handle...