CVE-2026-98757

A flaw was found in the Linux kernel's Cadence USB3 gadget driver. This vulnerability can lead to a Denial of Service DoS through a system crash or potentially allow privilege escalation. During device teardown, the driver releases memory without waiting for pending background work tasks to finis...

CVE-2026-98756

A flaw was found in the Linux kernel's Cadence USB3 driver. A local user could exploit this flaw to cause a Denial of Service DoS by crashing the system. During device discovery of a multi-function Cadence USBSS Peripheral Component Interconnect PCI device, the driver attempts to access shared da...

CVE-2026-98755

A flaw was found in the Linux kernel's Virtual Console Concentrator VCC driver. When sending control messages across a Logical Domain Channel LDC, the driver transmits packets without completely clearing the allocated memory buffer first. A connected peer can inspect these messages to access...

CVE-2026-98754

A flaw was found in the Linux kernel's Virtual Console Concentrator VCC driver. An omission in locking allows a race condition to occur between device cleanup operations and asynchronous event callbacks. A local attacker could exploit this timing issue to cause a use-after-free condition,...

CVE-2026-98752

A flaw was found in the Linux kernel's TTY terminal subsystem. This vulnerability allows a local user to cause a Denial of Service DoS or potentially execute arbitrary code. A race condition during port disconnect and hangup routines allows the kernel to release resources while they are still bei...

CVE-2026-98753

A flaw was found in the Linux kernel's TTY subsystem. A local user can cause a Denial of Service DoS by triggering a race condition during terminal device activation and hangup operations. When device activation fails, the kernel fails to restore an error flag, allowing subsequent input/output...

CVE-2026-98751

A flaw was found in the Linux kernel's terminal tty subsystem. A race condition can occur when a terminal hangup interrupts an active break signaling operation, causing the kernel to communicate with a device driver after the device has already disconnected or powered down. A local attacker could...

CVE-2026-98747

A flaw was found in the Linux kernel's serial core subsystem. This flaw allows a local user with administrative access to cause a Denial of Service DoS by crashing the system. The issue occurs during the unregistration of a serial port that failed during initial setup or was previously torn down,...

CVE-2026-98746

A flaw was found in the Linux kernel's ma35d1 serial driver. This flaw allows a local user to cause a Denial of Service DoS through resource exhaustion. The driver fails to release clock references during probe error handling or when the serial port is removed, causing kernel resources to leak up...

CVE-2026-98745

A flaw was found in the Linux kernel. A local user can exploit this vulnerability to cause a denial of service DoS through a kernel crash. On ARM64 systems that support the Scalable Matrix Extension SME but lack the Scalable Vector Extension SVE, the kernel improperly validates vector signal...

CVE-2026-111100

A flaw was found in the Kiloview E3 Open Network Video Interface Forum ONVIF device service. The service responds to specific informational requests without requiring authentication, resulting in information disclosure. A remote, unauthenticated attacker can exploit this issue to retrieve sensiti...

CVE-2026-110825

A flaw was found in Kiloview E3. The device's Open Network Video Interface Forum ONVIF service accepts network and time configuration write operations without enforcing authentication. A remote, unauthenticated attacker can exploit this flaw to alter the device hostname, redirect Domain Name Syst...

CVE-2026-110491

A flaw was found in Kiloview E3. An unauthenticated remote attacker can cause a Denial of Service DoS by sending malformed or incomplete requests to the Open Network Video Interface Forum ONVIF service. Successful exploitation renders the service unresponsive to new connections, temporarily...

CVE-2026-98744

A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows uninitialized values to be processed by the sound subsystem,...

CVE-2026-98743

A flaw was found in the Linux kernel's rt1017 SDCA audio codec driver. The driver fails to initialize stream configuration data before passing it to the sound subsystem, leaving configuration fields populated with uninitialized memory. A local user could exploit this flaw during audio stream...

CVE-2026-114616

A flaw was found in Authlib. The library improperly accepts zero-length key material during Hash-based Message Authentication Code HMAC signing and verification. If a host application verifies tokens using a secret that evaluates to an empty value, a remote attacker can generate predictable...

CVE-2026-98741

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture UA-101 USB audio driver. The driver does not validate that packet sizes and channel numbers match between capture and playback endpoints during device initialization. An attacker who connects a specially crafted USB...

CVE-2026-98740

A flaw was found in the Linux kernel's Altera Error Detection and Correction EDAC driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device registration is deferred or manually re-triggered, the driver...

CVE-2026-114613

A flaw was found in msgpack. A remote attacker could trigger a memory leak by sending specially crafted MessagePack data containing rejected map keys during deserialization. Repeated transmission of such malformed inputs can lead to excessive process memory consumption, resulting in a Denial of...

CVE-2026-112892

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted Microsoft Paint MSP image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding RLE decoder expands image da...

CVE-2026-111497

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...

CVE-2026-98739

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A local user could exploit this flaw to cause a Denial of Service DoS or potentially escalate privileges. A race condition between concurrent device installation and release operations allows reference counts to be dropped...

CVE-2026-98736

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during enhanced Synchronous Connection-Oriented SCO link setup due to missing locking when accessing parent connection structures. A local user or adjacent attacker could exploit this timing window by concurrently...

CVE-2026-98735

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when outgoing network packets are scheduled while the associated communication channel is concurrently closed and freed during connection teardown. A local attacker could exploit this flaw to trigger a...

CVE-2026-114615

A flaw was found in Authlib. When verifying JSON Web Tokens JWT, the library fails to properly recognize asymmetric public keys that contain leading whitespace, comments, or formatting prefixes. An unauthenticated remote attacker who knows the public key can exploit this flaw to forge symmetric...

CVE-2026-98731

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. An integer overflow vulnerability exists in the packet reception function when calculating the total length of incoming Bluetooth frames. An adjacent attacker within Bluetooth range could exploit this flaw by transmitting special...

CVE-2026-98732

A flaw was found in the Linux kernel's Intel Bluetooth driver. When processing hardware error events, the driver logs event data as a string without verifying that the received payload is properly null-terminated. A physically proximate attacker or compromised Bluetooth device could exploit this...

CVE-2026-115504

A flaw was found in cfitsio. An attacker could exploit this vulnerability by enticing a user or automated system to process a specially crafted Flexible Image Transport System FITS file. Due to improper bounds checking when handling variable-length string columns in the ffgcls2 function, an...

CVE-2026-114614

A flaw was found in Authlib. The library's transport security verification improperly validates web addresses by using prefix matching to exempt local loopback addresses from encryption requirements. A remote attacker can exploit this issue by supplying a crafted URL containing local host...

CVE-2026-98728

A flaw was found in the Linux kernel's Trusted Platform Module TPM driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to...

CVE-2026-115389

A flaw was found in Wasmtime. The runtime does not adequately account for host memory allocations when converting guest values through the dynamically-typed Val application programming interface API, bypassing configured resource consumption limits. A malicious WebAssembly guest can exploit this...

CVE-2026-115386

A flaw was found in Wasmtime. An information disclosure vulnerability exists in the WebAssembly System Interface WASI directory reading implementation, which copies uninitialized structure padding into guest memory. A guest module with access to a preopened directory can exploit this issue by...

CVE-2026-115393

A flaw was found in Wasmtime. Several Store application programming interfaces APIs fail to verify that objects belong to the expected execution engine. If an embedding application mixes objects between different engines, this type confusion can lead to memory corruption, including out-of-bounds...

CVE-2026-101779

A flaw was found in the MySQL Server Telemetry component. A remote attacker with high privileges and network access can exploit this vulnerability over multiple protocols to cause a partial Denial of Service DoS. Successful exploitation can lead to unauthorized degradation of database service...

CVE-2026-114620

A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery SSRF by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies ...

CVE-2026-114617

A flaw was found in Authlib. When validating OpenID Connect OIDC identity tokens, the library improperly relies on a claim within the incoming token to decide whether to enforce nonce verification, which binds the token to an active session. A remote attacker with a captured, validly signed token...

CVE-2026-114619

A flaw was found in Authlib. This vulnerability allows an authenticated client to bypass authorization scope restrictions and obtain an unauthorized OpenID Connect OIDC identity token, leading to information disclosure. During an implicit grant authorization request, the application evaluates the...

CVE-2026-114618

A flaw was found in Authlib. In the default JSON Web Token JWT bearer grant implementation, audience claims are checked only for existence rather than validated against the target authorization server. A remote attacker holding a legitimate token issued for another service can present it to a...

CVE-2026-98726

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. A malicious NVMe device can provide crafted Asymmetric Namespace Access ANA log data that triggers an integer underflow during buffer bounds validation. This failure leads to an out-of-bounds memory read,...

CVE-2026-98730

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface HCI user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory...

CVE-2026-98727

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. The multipath driver inappropriately marks a storage device as supporting zoned storage before confirming its zone configuration. When a device reports a zone size of zero, subsequent read or write...

CVE-2026-98729

A flaw was found in the Linux kernel. On systems utilizing specific AMD processors, improper virtual address alignment for huge page memory mappings can allow a local user to cause a Denial of Service DoS. When unmapping these misaligned memory ranges during teardown, the kernel encounters an...

CVE-2026-115391

A flaw was found in Wasmtime. A malicious guest can cause a Denial of Service DoS on the host by submitting excessively large data buffers to file or HTTP write streams within the WebAssembly System Interface WASI. Because incoming guest writes are buffered in host memory without size limits, thi...

CVE-2026-115354

A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown input can exploit this flaw to read arbitrary local files fro...

CVE-2026-115350

A flaw was found in mistune. An attacker can exploit this vulnerability to conduct stored Cross-Site Scripting XSS attacks through the file inclusion directive. By referencing a crafted HTML file, unescaped content is processed as raw markup, enabling the execution of arbitrary script code in the...

CVE-2026-115351

A flaw was found in mistune. A remote attacker with control over markdown content can cause information disclosure by performing Cascading Style Sheets CSS injection through the unvalidated figwidth option in the figure directive. By inserting arbitrary style rules into rendered web pages, the...

CVE-2026-115486

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet...

CVE-2026-115485

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the...

CVE-2026-115484

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the...

CVE-2026-115390

A flaw was found in Wasmtime. This vulnerability allows an untrusted guest program to cause a Denial of Service DoS by bypassing execution limits. Due to an accounting flaw in Cranelift-compiled execution paths, a guest can reset consumed execution units known as fuel after specific function call...