CVE-2026-104591

A flaw was found in libosmocore. A buffer overflow vulnerability exists in the osmoiuupcomputepayloadcrc function during payload checksum calculation. A remote attacker could exploit this flaw to crash the application, resulting in a Denial of Service DoS. Mitigation --- CME Mitigation Guidance...

CVE-2026-90885

A flaw was found in Apache Camel's camel-saxon component. A remote attacker can exploit this vulnerability to cause information disclosure by sending specially crafted XML containing external entity declarations to an affected route. The issue occurs because the component's default parser...

CVE-2026-98903

A flaw was found in the Linux kernel's i.MX Messaging Unit MU mailbox driver. A local user could exploit a race condition during channel shutdown to cause a Denial of Service DoS. When a mailbox channel is closed while an interrupt is actively being processed, the receive event can be inadvertent...

CVE-2026-99082

A flaw was found in the Linux kernel. In the KVM Kernel-based Virtual Machine subsystem, the per-virtual CPU vCPU memory-mapped I/O MMIO cache does not properly track active memory slots when switching between normal execution and System Management Mode SMM. A privileged guest user can exploit th...

CVE-2026-107080

A flaw was found in OpenJPEG. An out-of-bounds read and write vulnerability exists in the encoder's discrete wavelet transform processing when handling images with specific tile geometries. An attacker who can supply crafted encoding parameters could exploit this flaw to cause heap memory...

CVE-2026-98902

A flaw was found in the Linux kernel's RAID5 storage driver. A sequence number comparison issue in stripe batch processing fails to account for 32-bit integer wrapping. During extensive storage write operations, the sequence counter may overflow, causing the system to misidentify newer stripe...

CVE-2026-99083

A flaw was found in the Linux kernel's ksmbd Server Message Block SMB server. When handling compounded SMB requests during Kerberos authentication, the server incorrectly calculates available buffer space, leading to a heap-based out-of-bounds write. A remote attacker could exploit this...

CVE-2026-89078

A flaw was found in Ruby. When compiling a specially crafted regular expression with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, a double free can occur when parsing a pattern that fails after an alternation. This double free causes memory...

CVE-2026-93577

A flaw was found in Ruby. When compiling a specially crafted regular expression with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, an integer overflow in the size of the compiled pattern can occur. This integer overflow causes memory...

CVE-2026-97229

A flaw was found in Ruby. When compiling a specially crafted regular expression with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, an integer overflow in the size of the compiled pattern can occur. This integer overflow causes memory...

CVE-2026-115369

A flaw was found in OpenBao. When processing a Certificate Signing Request CSR in the Public Key Infrastructure PKI engine, the service fails to enforce configured IP address restrictions against requested Subject Alternative Names SAN. An authenticated remote user with certificate signing...

CVE-2026-115360

A flaw was found in OpenBao. An open redirect vulnerability in the user interface for the OpenID Connect OIDC identity provider allows a remote attacker to redirect unauthenticated users to arbitrary, attacker-controlled websites. By convincing a victim to follow a crafted OIDC link, an attacker...

CVE-2026-80728

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. During device teardown, a timing issue can occur where memory used by the driver is released prematurely. This can happen during a device probe failure or rollback. This premature release leads to the driver attempting to write to an...

CVE-2026-98897

A flaw was found in the Linux kernel's ksmbd Kernel Server Message Block daemon. An authenticated remote user can cause a Denial of Service DoS by initiating conflicting file access requests on cached file leases. Because ksmbd holds an internal read lock while waiting for a lease break...

CVE-2026-99081

A flaw was found in the Linux kernel's Broadcom NetXtreme-E bnxten network driver, which can lead to a Denial of Service DoS. When transmitting small network packets that require padding, the driver fails to update the Direct Memory Access DMA mapping length to account for the padded size. As a...

CVE-2026-98900

A flaw was found in the Linux kernel's Xen grant allocation driver. A local user can exploit this vulnerability by submitting an excessively large grant allocation request before the driver validates it against global limits. This flaw allows excessive kernel memory consumption and integer...

CVE-2026-98898

A flaw was found in the Linux kernel's AMD GPU driver. When dynamic power management DPM is disabled, the driver attempts to schedule thermal management tasks on an uninitialized work queue upon receiving an interrupt. A local user could exploit this condition to trigger a kernel crash, resulting...

CVE-2026-80838

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN component. During certain network operations, specifically a filtered bulk flush, the system can incorrectly handle remote entries. This can lead to a memory corruption vulnerability where a read-copy update RCU reader attempts t...

CVE-2026-98896

A flaw was found in the Linux kernel's Thunderbolt driver. A race condition can occur when a device hotplug event is processed concurrently with driver removal, resulting in a use-after-free condition where freed memory is accessed. A local user could exploit this flaw to cause a Denial of Servic...

CVE-2026-93237

A flaw was found in the Linux kernel. An incorrect physical memory boundary check on LoongArch systems allows device memory allocations to fall outside the supported virtual memory mapping space. When the kernel attempts to map this out-of-bounds memory, an address wraparound occurs that silently...

CVE-2026-98894

A flaw was found in the AMD GPU driver within the Linux kernel. When handling overflow conditions in the Common Platform Error Record CPER ring buffer, the driver relies on parsed entry sizes from the buffer contents without verifying that the read pointer advances. Corrupt error record data can...

CVE-2026-98895

A flaw was found in the Linux kernel's mlx5 network driver. When destroying a hardware steering table configured with a default miss table, the driver fails to remove the entry from the associated miss table tracking list, leaving behind an invalid pointer. A local privileged user could exploit...

CVE-2026-99080

A flaw was found in the Linux kernel's file system component. When freeing file index records inodes, the kernel could fail to release unused internal data tracking nodes xarray nodes left behind during memory management operations. A local user could exploit this flaw to cause a persistent kerne...

CVE-2026-99075

A flaw was found in the Linux kernel's Rust Binder driver. When a thread terminates while holding a pending reference count update for an inter-process communication node, the update is improperly dropped instead of being rescheduled. This desynchronizes internal states and prevents userspace fro...

CVE-2026-99070

A flaw was found in the Linux kernel's IPv6 subsystem. When nexthop compatibility mode is enabled, a race condition between sizing and populating route notification buffers can trigger an unexpected kernel warning. A local user could trigger this condition during concurrent route modifications,...

CVE-2026-99068

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA ctxfi driver. When clearing Digital Audio Output DAO input mapping entries, the driver fails to properly free allocated memory. A local user could exploit this vulnerability by repeatedly triggering the operation, causi...

CVE-2026-98885

A flaw was found in the Linux kernel's Integrity Measurement Architecture IMA. When opening files on a read-only ext4 filesystem during boot, IMA attempts to update extended file attributes without properly verifying whether changes are permitted. This triggers a journal transaction failure and a...

CVE-2026-99079

A flaw was found in the Linux kernel's Mellanox network driver mlx5e. When network traffic redirected to an AFXDP eXpress Data Path socket encounters a full receive ring and buffer refills only partially succeed, the driver retains a stale buffer reference. A remote attacker could exploit this...

CVE-2026-99074

A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition can occur when updating Path Maximum Transmission Unit PMTU routes while next-hop routing groups are simultaneously reduced in size. A local user with network administration privileges, or an unprivileged user wher...

CVE-2026-99073

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS due to a race condition in the IPv4 routing subsystem. When routing table dumps execute concurrently with nexthop group updates that reduce the number of paths, the kernel attempts to access an absent path,...

CVE-2026-98893

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI sensor driver. The driver fails to verify that the received notification payload size is large enough to contain all expected sensor readings before parsing them. A malicious or compromised firmware platform c...

CVE-2026-98892

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware driver. The notification handler fails to properly validate the size of incoming base error event payloads before copying the report array. A compromised or malfunctioning firmware interface can provi...

CVE-2026-98891

A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. An adjacent attacker within wireless network range can trigger a Denial of Service DoS by sending a malformed or truncated deauthentication frame. The subsystem accesses the frame's reason code before verifying that th...

CVE-2026-98890

A flaw was found in the Linux kernel's Libertas wireless driver. When operating in monitor mode, the driver fails to properly validate the length of transmission frames before accessing header data. A local attacker could exploit this flaw by transmitting truncated monitor frames, triggering an...

CVE-2026-98889

A flaw was found in the Linux kernel's Intel Wi-Fi driver iwlwifi. During scheduled network scans, the driver copies Information Elements IEs—data fields used in wireless communications—into a fixed-size buffer before validating their length. A local user with network administration privileges ca...

CVE-2026-98888

A flaw was found in the Linux kernel's arm64 kprobes subsystem. When tracing or performance monitoring tools trigger a secondary probe while an initial probe is executing its single-step instruction, the kernel treats the event as unrecoverable and corrupts interrupt state tracking. A local user...

CVE-2026-98887

A flaw was found in the Linux kernel's mac80211hwsim wireless driver. By submitting a specially crafted, undersized Netlink message, a local user can trigger an out-of-bounds memory read due to improper message length validation. This flaw primarily allows an attacker to cause a kernel crash...

CVE-2026-98886

A flaw was found in the Linux kernel's gma500 graphics driver. This vulnerability can lead to a Denial of Service DoS when communicating over the display interface. Specifically, the driver ignores timeout and interruption signals while waiting for an HDMI High-Definition Multimedia Interface I2C...

CVE-2026-98884

A flaw was found in the Linux kernel's MultiMediaCard MMC subsystem. Due to missing input validation, an excessively large segment value configured by a host driver can be truncated to zero during memory allocation. When this occurs, the kernel attempts to access invalid memory, resulting in a...

CVE-2026-98883

A flaw was found in the Linux kernel's 8250 serial port driver. On systems utilizing MIPS Alchemy hardware, the driver fails to recognize a specific communication port type during device probing. This failure triggers an internal kernel warning during system startup, which can result in a Denial ...

CVE-2026-98882

A flaw was found in the Linux kernel's Chips Wave5 video processing driver. Missing bounds validation in the video decoder output handling allows the driver to write data outside allocated memory buffers. A local user could exploit this vulnerability to cause a Denial of Service DoS through a...

CVE-2026-98881

A flaw was found in the Linux kernel's bridge networking subsystem. An obsolete synchronization call during the deletion of bridge multicast devices causes severe lock contention within the networking layer. A local user could exploit this flaw by repeatedly creating and removing network bridge...

CVE-2026-98880

A flaw was found in the Linux kernel's ntfs3 file system driver. The driver fails to properly handle errors when configuring the block size while mounting a file system. A local user could exploit this flaw by mounting a specially crafted NTFS image with an unsupported block size, triggering a...

CVE-2026-98879

A flaw was found in the Linux kernel's ISO 9660 isofs file system driver. The driver fails to handle errors when setting the storage block size during mount operations. A local user could exploit this flaw by mounting a specially crafted disk image with an invalid block size, triggering a kernel...

CVE-2026-98878

A flaw was found in the Linux kernel's Generic Interrupt Controller version 5 GICv5 driver. The driver delayed dropping an interrupt's priority until full deactivation rather than immediately after acknowledging it. When an interrupt remains active during a long-running operation or guest virtual...

CVE-2026-92171

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site xsite TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments -tlskeystorepassword, -tlstruststorepassword. Container arg...

CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116262

A flaw was found in libimobiledevice. A remote attacker can trigger a heap-based buffer overflow in the Web Inspector component by sending specially crafted input during packet processing in the webinspectorreceivewithtimeout function. This issue can cause the application to crash, leading to a...

CVE-2026-115718

A flaw was found in Frappe Builder. A missing authorization check in the improveprompt endpoint allows an authenticated remote attacker to invoke Large Language Model LLM completions using the site owner's stored credentials. By exploiting this issue, an attacker can exhaust paid service credits...

CVE-2026-115717

A flaw was found in Frappe Builder. An authenticated user with low privileges can trigger a Server-Side Request Forgery SSRF vulnerability by submitting a malicious URL to the converttowebp API endpoint, which lacks proper access controls and redirect validation. This allows the attacker to coerc...