CVE-2026-98709

A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. During channel context switching operations across multiple virtual interfaces, improper tracking of link reservations can cause an active channel context to be released prematurely while still in use by the driver. A...

CVE-2026-91452

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...

CVE-2026-91464

A flaw was found in OpenJDK's Java Generic Security Services JGSS component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure...

CVE-2026-91463

A flaw was found in the JGSS Java Generic Security Services component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access ...

CVE-2026-98670

A flaw was found in the Linux kernel's Xilinx XADC driver. During device unbinding, an improper cleanup order allows interrupt requests IRQs to remain active after delayed work has been cancelled. A local user capable of detaching the device can cause an interrupt to schedule work that executes...

CVE-2026-91417

A flaw was found in the Common Object Request Broker Architecture CORBA component of OpenJDK. An unauthenticated remote attacker could exploit this flaw by sending specially crafted data to exposed application programming interfaces APIs over the network. A successful attack can result in a parti...

CVE-2026-91418

A flaw was found in OpenJDK's ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service DoS, degrading application...

CVE-2026-98734

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker could exploit this flaw to cause a Denial of Service DoS via a system crash or potentially escalate privileges. The vulnerability occurs due to improper synchronization between packet transmission scheduling and connecti...

CVE-2026-91411

A flaw was found in the Java Generic Security Services JGSS component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to applications or services utilizing JGSS APIs. A successful attack can cause the application to hang or...

CVE-2026-91462

A flaw was found in the Java Generic Security Services JGSS component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces APIs, such as through a web service. A successful attack...

CVE-2026-98632

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can trigger a use-after-free condition by cancelling a pending Bluetooth mesh transmission while it remains queued for processing. When the system later attempts to handle the queued transmission using the already freed...

CVE-2026-91451

A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces APIs, such as through web services. Successful exploitation enables ...

CVE-2026-91415

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces APIs, such as through a web service or application that processes graphics data. A successful attack...

CVE-2026-114370

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

CVE-2026-114114

A flaw was found in Vyper. The compiler improperly calculates source code positions by mixing character-based offsets with byte offsets during parsing. An attacker contributing source code can exploit this flaw by introducing multi-byte characters or invisible markers to shift internal code...

CVE-2026-71195

A flaw was found in OpenStack Manila. When a file share is configured with public visibility, the service fails to verify project ownership before authorizing management operations. An authenticated user in a separate project can exploit this issue by submitting modification requests for public...

CVE-2026-93247

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS due to a race condition in the service discovery management code. Under specific timing conditions, clearing discovery filters concurrently with starting service discovery leaves interna...

CVE-2026-98631

A flaw was found in the Linux kernel. A local attacker can cause a Denial of Service DoS or potentially expose sensitive memory by triggering an out-of-bounds read in the Berkeley Packet Filter BPF socket map implementation. This issue occurs because socket map lookups perform a 64-bit comparison...

CVE-2026-98788

A flaw was found in the Linux kernel's futex fast userspace mutex subsystem. When resizing a private hash table, improper synchronization allows the old table memory to be released while another thread is still referencing it. A local attacker could exploit this race condition to trigger a...

CVE-2026-93211

A flaw was found in the nfsd component of the Linux kernel. Due to an incorrect initialization order of the Dynamic Resource Cache DRC hash table, a system crash Denial of Service can occur on weakly-ordered architectures like ARM64 and PowerPC. This happens when a shrinker scan attempts to acces...

CVE-2026-114118

A flaw was found in Vyper. When deploying smart contracts from blueprints reusable contract templates, the createfromblueprint function calculates remaining code size without verifying that the offset is within the template boundaries, causing an integer calculation error. A remote attacker...

CVE-2026-98620

A flaw was found in the Linux kernel's MediaTek Ethernet driver mtkethsoc. This issue allows a local attacker to cause a Denial of Service DoS by triggering a failure during the network device registration probe sequence. When registration fails, the driver's error cleanup path frees registered...

CVE-2026-98619

A flaw was found in the Linux kernel's ethtool subsystem. A local user with network administration privileges can cause a Denial of Service DoS by initiating an offline self-test on affected network drivers. Because the test routine fails to hold the necessary synchronization locks when taking th...

CVE-2026-98618

A flaw was found in the Linux kernel's fbnic network driver. When configuring the maximum number of standalone transmission and reception channels, the driver under-allocates vector resources, leaving uninitialized entries. This flaw allows a local user with administrative privileges to trigger a...

CVE-2026-102829

A flaw was found in simple-git. The software fails to include the VISUAL environment variable in its unsafe editor detection checks. If a consuming application accepts untrusted environment variables, an attacker can specify a malicious program that Git launches during interactive operations,...

CVE-2026-98628

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A privileged local user can cause a Denial of Service DoS by loading a specially crafted BPF program containing numerous redundant instructions that trigger intensive post-verification cleanup. Because these rewrite...

CVE-2026-98629

A flaw was found in the Linux kernel's u32 traffic control classifier clsu32. A local user with network administration privileges can trigger this flaw by creating and removing filter hash tables with manually assigned handles. Due to an identifier mismatch between table creation and deletion...

CVE-2026-98098

A flaw was found in the Linux kernel. A local user can trigger a Denial of Service DoS by binding an excessive number of service addresses to sockets in the Transparent Inter-Process Communication TIPC subsystem. When the internal name table reaches its capacity limit, required protocol service...

CVE-2026-98627

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When verifying packet pointer registers that share an identifier, the BPF verifier fails to preserve register displacement during state pruning. A local user with permission to load BPF programs could exploit this...

CVE-2026-98622

A flaw was found in the Linux kernel's traffic control connection tracking subsystem. Under normal load or during connection tracking flushes, expected memory allocation failures inappropriately trigger a kernel warning. A local user can exploit this condition by racing connection flushes against...

CVE-2026-98630

A flaw was found in the Linux kernel's fbnic network driver. When memory allocation for a payload page pool fails, the error cleanup routine incorrectly attempts to destroy an invalid error pointer instead of releasing the allocated header page pool. A local user able to trigger interface queue...

CVE-2026-98624

A flaw was found in the Linux kernel's netfilter subsystem. A race condition exists between socket release event processing and configuration requests within the nfnetlinkqueue component. A local user could exploit this vulnerability by executing concurrent socket operations, triggering a kernel...

CVE-2026-98086

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA subsystem. When configuring Universal MIDI Packet UMP devices, the driver prematurely treats endpoint structures as fully initialized before legacy MIDI data structures are attached. A local user or connected device...

CVE-2026-98085

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local user with permissions to load BPF programs could exploit this vulnerability to cause a Denial of Service DoS via a kernel crash or potentially bypass verifier safety checks. This issue occurs because the verifier...

CVE-2026-98623

A flaw was found in the Linux kernel's Nouveau driver. A local user can trigger an out-of-bounds read by requesting an invalid clock performance state through the debugfs interface. This issue can lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-98625

A flaw was found in the Linux kernel's netfilter subsystem. A timing conflict, or race condition, in the flowtable offload component allows flow data to be prematurely released from memory while still being processed by a cleanup worker. A local attacker could exploit this use-after-free...

CVE-2026-98626

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When processing Compile Once – Run Everywhere CO-RE relocation records, the kernel modifies target instructions before verifying that the instruction is an eligible relocation target. A local user can exploit this...

CVE-2026-98621

A flaw was found in the Linux kernel's Generic UDP Encapsulation GUE networking component. A remote attacker could exploit this vulnerability by sending specially crafted network packets containing invalid remote checksum offsets. This improper input validation causes an integer underflow, allowi...

CVE-2026-111678

A flaw was found in antiword. An out-of-bounds read vulnerability exists in the document parser due to missing bounds checks when processing internal formatting data. By tricking a user into opening a specially crafted Microsoft Word document, an attacker could cause the application to crash,...

CVE-2026-55862

A flaw was found in libupnp. Several Document Object Model DOM traversal functions process deeply nested XML structures using unbounded recursion. An unauthenticated attacker on the local network can exploit this flaw by sending a crafted SOAP request containing deeply nested XML, exhausting stac...

CVE-2026-112062

A flaw was found in lwIP. An adjacent attacker on the local network can cause a Denial of Service DoS by sending specially crafted multicast Domain Name System mDNS responses with invalid domain names or record lengths. Processing these malformed packets during a service search triggers a...

CVE-2026-111879

A flaw was found in perl-DBI. When creating or opening a database table in the DBD::DBM module fails due to an error, an exclusive file lock acquired during initialization is not properly released. A user or attacker who can control connection parameters can trigger this failure, leaving the lock...

CVE-2026-112063

A flaw was found in libstrophe. A malicious XMPP Extensible Messaging and Presence Protocol server can exploit a stack-based buffer overflow in the SCRAM Salted Challenge Response Authentication Mechanism authentication handler by sending an oversized salt value. This issue allows an attacker to...

CVE-2026-112059

A flaw was found in liblas. By convincing a user to process a specially crafted LAS file containing an oversized schema record, an attacker can trigger an integer truncation issue during memory allocation. This flaw leads to a heap-based buffer overflow, causing an application crash or memory...

CVE-2026-112020

A flaw was found in lodepng. A missing bounds check in the getFilterTypesInterlaced function allows an out-of-bounds memory read when handling decompressed image data. An attacker could exploit this flaw by supplying a specially crafted interlaced PNG image for processing, resulting in a Denial o...

CVE-2026-111677

A flaw was found in Antiword. An attacker could exploit this vulnerability by enticing a user to open a specially crafted Word document. Due to an incorrect bounds check when parsing list records, processing the file triggers an out-of-bounds read from memory, causing the application to crash and...

CVE-2026-113776

A flaw was found in virtualenv. An attacker who can influence an environment's path or prompt setting can achieve arbitrary command execution when a user activates the virtual environment. This issue occurs because activation templates process substitution placeholders sequentially, allowing...

CVE-2026-77630

A flaw was found in libupnp. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by submitting requests containing slow or non-responsive hostnames. Because the library performs synchronous network address lookups on attacker-supplied hostnames, worker...

CVE-2026-57487

A flaw was found in libupnp. The HTTP parser fails to enforce configured message size limits when processing chunked transfer-encoded HTTP requests. A remote attacker can exploit this vulnerability by sending an excessively large chunked payload, forcing the application to buffer data beyond...

CVE-2026-98617

A flaw was found in the Linux kernel's Meta Host Network Interface fbnic driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue memory. A privileged local user could trigger this flaw duri...