CVE-2026-98977

A flaw was found in the Linux kernel. A local attacker with the ability to create user and mount namespaces can trigger an improper filesystem lock during an automatic mount automount operation. Because the kernel incorrectly assigns mount locks across namespaces during propagation, the lock is...

CVE-2026-98980

A flaw was found in the Linux kernel. A race condition during reference-based path lookup allows a local user to access files hidden beneath mount points, resulting in information disclosure. When an overmounted file or directory is unlinked or removed while another process traverses the path, th...

CVE-2026-98972

A flaw was found in the Linux kernel. A local user could trigger a use-after-free vulnerability when a control group cgroup filesystem is rebound, causing the cpuset subsystem to access a stale pointer. This flaw can lead to a Denial of Service DoS by crashing the system or potentially allow...

CVE-2026-99022

A flaw was found in the Linux kernel's LTC3676 regulator driver. The driver improperly marks write-only command registers, including the hardware reset register, as readable. A local user with administrative privileges can cause a Denial of Service DoS by reading the regulator registers through...

CVE-2026-99097

A flaw was found in the Linux kernel's Trusted Execution Environment TEE subsystem. A local user can cause a Denial of Service DoS by requesting a zero-sized shared memory allocation. Because the subsystem fails to validate the requested allocation size before calculating page counts, the kernel'...

CVE-2026-117997

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget component...

CVE-2026-117602

A flaw was found in Electrum. The external plugin loader does not verify authorization signatures before executing enabled plugins. A local attacker with write access to the application data directory can place malicious plugin code into the plugins folder and enable it in the configuration file...

CVE-2026-117574

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials fr...

CVE-2026-116690

A flaw was found in MLflow. Due to improper path validation during model version creation, the application allows local file paths to be assigned as model artifact locations. A remote attacker can exploit this vulnerability by submitting a server-local path and retrieving it through the artifact...

CVE-2026-116672

A flaw was found in Authlib. An authenticated remote attacker can bypass authorization controls to access, modify, or delete configurations belonging to other clients. In deployments implementing the documented reference code for dynamic client configuration, the server validates client editabili...

CVE-2026-116591

A flaw was found in the klauspost compress library. A remote attacker can exploit this vulnerability by submitting a specially crafted Zstandard zstd compressed stream to an application using the library, resulting in a Denial of Service DoS. Due to an integer handling error in the decompression...

CVE-2026-116587

A flaw was found in go-jose. A remote attacker can cause a Denial of Service DoS by supplying a crafted JSON Web Key JWK with oversized or degenerate RSA cryptographic parameters. Because the library fails to enforce size and consistency bounds prior to validation, processing these malicious keys...

CVE-2026-116586

A flaw was found in go-jose. A remote attacker could cause a Denial of Service DoS by submitting specially crafted, deeply nested JSON JavaScript Object Notation input to an affected application. When parsing these deeply nested arrays or objects, the system exceeds its stack memory limits,...

CVE-2026-116585

A flaw was found in go-jose. Insufficient input validation during the decryption of untrusted JSON Web Encryption JWE ciphertext allows an empty buffer to be indexed during CBC-HMAC unpadding. A remote attacker can exploit this flaw by providing crafted ciphertext, triggering an application panic...

CVE-2026-115893

A flaw was found in Wasmtime. When compiling WebAssembly Wasm branch table instructions with an unusually large number of targets on 64-bit ARM AArch64 systems, the Cranelift compiler backend generates an incorrect branch target. An attacker supplying a specially crafted WebAssembly module can...

CVE-2026-115889

A flaw was found in Wasmtime. An attacker could achieve a sandbox escape and compromise the host system by supplying a specially crafted WebAssembly Wasm module. When compiling functions containing an unusually large number of internal values, an integer overflow in the Cranelift compiler backend...

CVE-2026-115825

A flaw was found in perl-Plack. The HTTP::Server::PSGI server pre-allocates memory for incoming request bodies based entirely on the declared Content-Length header before reading data. A remote attacker can exploit this flaw by sending an HTTP request with an excessively large Content-Length...

CVE-2026-115824

A flaw was found in Starman. The chunked request body decoder does not properly limit chunk sizes or line lengths, leading to unbounded memory buffering. A remote attacker can exploit this vulnerability by sending streaming chunked requests, exhausting server memory and causing a Denial of Servic...

CVE-2026-115817

A flaw was found in Starman. A remote attacker can cause a Denial of Service DoS by sending complete HTTP request headers and then stalling or slowly transmitting the request body. Because request bodies are read without enforcing an active timeout deadline, worker processes remain blocked...

CVE-2026-115384

A flaw was found in Wasmtime. A malicious guest can trigger a stack-based buffer overflow by supplying asynchronous callback functions with mismatched result types. This vulnerability allows the guest to overwrite host stack memory, enabling them to escape the WebAssembly Wasm sandbox, potentiall...

CVE-2026-114053

A flaw was found in vLLM. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution in the server process. By submitting a crafted multimodal request specifying an attacker-controlled code revision, an attacker can cause the application to load and execute...

CVE-2026-113877

A flaw was found in HTTP::Headers::ActionPack. A remote attacker can trigger a Denial of Service DoS by sending an HTTP request with a crafted Accept-Language header to an affected application. Because language range values are evaluated as regular expression patterns without proper sanitization,...

CVE-2026-112393

A flaw was found in Pillow. When saving compressed Tagged Image File Format TIFF images into memory buffers rather than direct files, the library incorrectly calculates the required memory allocation. A remote attacker who supplies a crafted image for processing can trigger a heap-based buffer...

CVE-2026-112077

A flaw was found in radare2. When the embedded HTTP server is running, the sandbox mechanism fails to restrict process execution due to overly permissive default policy settings. A remote attacker with network access to an exposed HTTP command service can exploit this issue by sending commands th...

CVE-2026-111810

A flaw was found in Apache Traffic Server. When processing incoming requests, the server writes an unthrottled diagnostic log entry for each internal header that it strips. A remote attacker can exploit this issue by sending HTTP requests with an unusually high number of internal headers, causing...

CVE-2026-111808

A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending a malformed padded HTTP/2 DATA frame. This issue causes the exhaustion of the backend HTTP/1.1 origin server's worker pool, resulting in a Denial of Service DoS. Mitigation Upgrade Apache Traffi...

CVE-2026-111805

A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending an HTTP/2 request containing a truncated Content-Length header. This causes Apache Traffic Server to exhaust the worker connection pool of upstream HTTP/1.1 origin servers, resulting in a Denial...

CVE-2026-111804

A flaw was found in Apache Traffic Server's experimental WebAssembly WASM plugin. A remote attacker can trigger a use-after-free condition during transaction closure or supply unvalidated metric identifiers to the internal statistics interface. This flaw allows an attacker to cause an application...

CVE-2026-102486

A flaw was found in NTPsec. This flaw allows a remote attacker to cause a Denial of Service DoS by crashing the NTP daemon. The issue is caused by an out-of-bounds read vulnerability when parsing Network Time Security NTS extension fields that contain an Authenticator and Encrypted Extension Fiel...

CVE-2026-100707

A flaw was found in Kyverno. Inconsistent path validation allows an authenticated user with low privileges to bypass namespace isolation boundaries by using percent-encoded directory traversal sequences in policy API requests. An attacker can exploit this issue to access and read sensitive...

CVE-2026-100704

A flaw was found in Kyverno. When evaluating image validation policies, the policy exception handler fails to restrict exemptions to specific designated images, applying the exception to all images within a matching resource instead. An authenticated user can exploit this vulnerability to bypass...

CVE-2026-98999

A flaw was found in the Linux kernel's Intel Xe graphics driver drm/xe. A local user could exploit this vulnerability to cause a denial of service DoS or potentially escalate privileges. When a graphics buffer object is pinned both externally and as a display framebuffer, releasing the external...

CVE-2026-77167

A flaw was found in Nextcloud. An unauthenticated remote attacker can abuse the federated sharing endpoint to inject arbitrary rows into the database. Because these entries are never automatically cleaned up, they cause persistent Denial of Service DoS conditions that disrupt system availability...

CVE-2026-65627

A flaw was found in jose. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS through memory exhaustion. When processing JSON Web Encryption JWE tokens that use compression, the library decompresses the payload without enforcing limits on the output size ...

CVE-2026-13451

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious storageUri. This Server-Side Request Forgery SSRF vulnerability allows the storage-initializer init container to issue...

CVE-2025-55702

A flaw was found in Apache Traffic Server. When a client sends a POST request with an Expect header and the origin server responds before consuming the full body, Traffic Server incorrectly parses the remaining unread body as a subsequent request. A remote attacker behind a front-end proxy sharin...

CVE-2026-98927

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM subsystem on ARM64 platforms. In nested virtualization setups, reallocating shadow page table memory during virtual processor initialization can leave an active virtual processor referencing memory that has already been freed...

CVE-2026-98952

A flaw was found in the Linux kernel's Packet Forwarding Control Protocol PFCP component. A remote attacker can exploit this vulnerability by sending a truncated or fragmented PFCP packet with the session flag enabled, causing the kernel to read memory beyond the end of the packet buffer. This...

CVE-2026-84725

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-19610

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control RBAC...

CVE-2026-114488

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to...

CVE-2026-15564

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and dependi...

CVE-2026-98974

A flaw was found in the Linux kernel's XFS file system. This vulnerability allows a local user to cause unauthorized data modification or potential privilege escalation by bypassing Copy-on-Write CoW protections. When exchanging file data ranges up to the end of a file, the file system incorrectl...

CVE-2026-99092

A flaw was found in the Linux kernel's RISC-V architecture. An issue in the instruction patching mechanism improperly handles memory allocated for Berkeley Packet Filter Just-In-Time BPF JIT compilation under specific kernel memory configurations. A local user capable of loading BPF programs can...

CVE-2026-99090

A flaw was found in the Linux kernel's AMD GPU driver. A local user could cause a Denial of Service DoS or system instability by triggering GPU recovery operations. Due to a race condition, the driver allows vertical blanking vblank counter reads from display hardware without proper lock...

CVE-2026-99067

A flaw was found in the Linux kernel's Btrfs file system. When path resolution encounters an error while reporting scrub warnings, the kernel fails to release an acquired reference to the file system root structure. A local user could trigger this condition during file system scrubbing to cause a...

CVE-2026-99063

A flaw was found in the Linux kernel's Device Mapper DM subsystem. When processing certain input/output control ioctl requests with minimal buffer sizes, the interface fails to properly validate that the result buffer's start offset remains within the allocated memory boundaries. A local attacker...

CVE-2026-99057

A flaw was found in the Linux kernel's Xen network frontend driver. When processing a network response chain that exceeds the allocated buffer capacity, an error handling failure prevents the socket buffer and associated memory pages from being freed. A malicious or compromised backend can exploi...

CVE-2026-99059

A flaw was found in the Linux kernel's WireGuard implementation. A race condition during the processing of duplicate handshake response messages can allow a remote network peer to cause an inconsistent session state. When duplicate responses are handled concurrently with a new handshake initiatio...

CVE-2026-99062

A flaw was found in the Linux kernel's virtual socket VSOCK virtio implementation. A local user can trigger a denial of service DoS due to an integer underflow in receive byte accounting. When an application performs a partial read on a stream socket, the kernel incorrectly calculates the remaini...