CVE-2026-98616

A flaw was found in the Linux kernel's fbnic driver. This flaw allows a local user to trigger a kernel crash, resulting in a Denial of Service DoS. During power management suspend or failed resume operations, the driver frees interrupt vectors without clearing the active vector counter. When the...

CVE-2026-98615

A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a Denial of Service DoS by initiating a reset or teardown of the firmware mailbox. Because the driver fails to properly drain pending write requests from the hardware pipeline...

CVE-2026-95117

A flaw was found in jsmn. A remote attacker can exploit a buffer overflow by providing specially crafted JSON input to the parser. Successful exploitation causes the application to crash, resulting in a Denial of Service DoS...

CVE-2026-98614

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. An attacker could exploit this vulnerability to cause a Denial of Service DoS by triggering an infinite loop during retransmission path selection. When all candidate network paths are in an unconfirmed...

CVE-2026-98612

A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing crafted packet headers, causing the driver to read beyond the...

CVE-2026-98613

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service DoS by creating deeply nested or cyclical object references using local kernel pointers. During object cleanup, synchronous recursive...

CVE-2026-114236

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...

CVE-2026-114047

A flaw was found in FreeRDP. The FreeRDP proxy accepts untrusted target TLS certificates when no verification module is configured. A network-positioned attacker who can intercept the proxy's outbound connection can present a self-signed or wrong-hostname certificate to impersonate the RDP target...

CVE-2026-114046

A flaw was found in FreeRDP. The smartcard emulation backend accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or wcscmp to crash the client process. This issue affects FreeRDP 3.0.0...

CVE-2026-114044

A flaw was found in FreeRDP. The Android client does not validate mappedWidth and mappedHeight from RDPGFXMAPSURFACETOWINDOWPDU against the surface buffer. A malicious RDP server can cause androidUpdateWindowFromSurface to read beyond the allocation, leading to crashes or memory disclosure. This...

CVE-2026-114043

A flaw was found in FreeRDP. WinPR's clipboard PNG-to-CFDIB synthesis allocates a bit-packed buffer for PNGs with bit depth below 8, while winprbitmapwritebuffer copies rows assuming one byte per pixel. A malicious RDP server can send a crafted low-bit-depth PNG clipboard payload that, when paste...

CVE-2026-114042

A flaw was found in FreeRDP. The drdynvc channel frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a crafted Virtual Channel PDU to trigger the free and crash the client during teardown. This issue affects...

CVE-2026-114041

A flaw was found in FreeRDP. On Windows builds, clientclipresentgatewaymessage passes a byte count as wide-character printf precision when printing RD Gateway consent or service messages. A malicious RD Gateway can send crafted pre-authentication messages, causing the client to read beyond the...

CVE-2026-108518

A flaw was found in the perl-dbi package. A type confusion vulnerability in the profiling feature can lead to an invalid memory dereference, causing the application to crash and resulting in a Denial of Service DoS. A user or attacker capable of supplying profiling configuration, such as through...

CVE-2026-114045

A flaw was found in FreeRDP. An integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDCFORMATS PDUs, causing an unbounded heap write during server audio playback that may...

CVE-2026-17557

A flaw was found in the lm-evaluation-harness component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the JobSpec. This vulnerability allows for the disclosure of the tenant's model authentication secret ...

CVE-2026-98611

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. The bpfcryptoctxcreate function attempts to read reserved fields from a parameter structure prior to verifying that the supplied buffer is sufficiently large. A local user capable of loading BPF programs can exploit this...

CVE-2026-98610

A flaw was found in the Linux kernel's Hierarchical Fair Service Curve HFSC network packet scheduler. A local user with network administration privileges, such as within a user namespace, can exploit this flaw to cause a Denial of Service DoS. Due to a lack of revalidation when traffic class leve...

CVE-2026-113726

A flaw was found in virtualenv. When an environment activation script is sourced in the Z shell zsh, prompt values such as the environment name are not properly escaped. An attacker who convinces a user to activate a virtual environment with a maliciously crafted directory name or prompt...

CVE-2026-113732

A flaw was found in virtualenv. The Fish shell activation script generator improperly sanitizes and quotes environment paths and prompt values. If an attacker can influence these values, specially crafted input can break out of the script's quoting syntax. Consequently, this flaw allows arbitrary...

CVE-2026-111767

A flaw was found in the Model Context Protocol MCP TypeScript SDK @modelcontextprotocol/sdk. The experimental task storage feature taskStore does not verify which client session created a given task when multiple clients share a task store. A remote attacker sharing the same server instance can...

CVE-2026-92823

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...

CVE-2026-92824

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an...

CVE-2026-92822

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content...

CVE-2026-113221

A flaw was found in the Google Lens component of chromium-browser. This issue is caused by a use-after-free vulnerability, which occurs when memory is accessed after it has been released. A remote attacker could exploit this flaw by enticing a user to open a specially crafted HTML page, potential...

CVE-2026-113037

An use after free flaw was found in the WebSockets component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=560939312 https://code.google.com/p/chromium/issues/detail?id=113037...

CVE-2026-113271

A flaw was found in the Accessibility component of Chromium. A remote attacker could exploit this vulnerability to execute arbitrary code by convincing a user to open a specially crafted HTML page. This issue occurs due to a use-after-free condition—where memory is improperly accessed after being...

CVE-2026-113019

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the browser sandbox by convincing a user to open a specially crafted HTML page. This vulnerability is caused by a use-after-free condition in the Turbolev component, where the application references memory...

CVE-2026-113240

A flaw was found in the Chromecast component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page, triggering a use-after-free condition where memory is accessed after being released. Successful exploitation could allow the...

CVE-2026-113079

A flaw was found in the SiteIsolation component of Chromium. A remote attacker could exploit this vulnerability by enticing a user to view a specially crafted HTML page, triggering a use-after-free memory error. Successful exploitation allows the attacker to execute arbitrary code within the...

CVE-2026-113200

An use after free flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/563350676...

CVE-2026-113250

An use after free flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/490808751...

CVE-2026-113233

An out of bounds read flaw was found in the Core component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=562111801 https://code.google.com/p/chromium/issues/detail?id=113233...

CVE-2026-113071

A flaw was found in chromium-browser. A use-after-free vulnerability exists in the Notifications component, occurring when memory is accessed after it has already been freed. A remote attacker could exploit this flaw by enticing a user to visit a specially crafted HTML page, potentially leading t...

CVE-2026-112993

An use after free flaw was found in the Input component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=572893186 https://code.google.com/p/chromium/issues/detail?id=112993...

CVE-2026-113295

An out of bounds read flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568897206...

CVE-2026-113253

A flaw was found in chromium-browser. This flaw allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to visit a specially crafted HTML page. The vulnerability stems from a use-after-free issue—referencing memory after it has been released—within the...

CVE-2026-113001

A flaw was found in chromium-browser. A use-after-free vulnerability in the Workers component allows a remote attacker to execute arbitrary code inside the browser sandbox. To exploit this flaw, an attacker must trick a user into opening a specially crafted HTML page...

CVE-2026-113302

A flaw was found in chromium-browser. A remote attacker can exploit a use-after-free issue—where memory is accessed after it has been released—within the Extensions component by convincing a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to execute...

CVE-2026-113101

A flaw was found in chromium-browser. A remote attacker could execute arbitrary code within the sandbox environment by convincing a user to open a specially crafted HTML page. This vulnerability is due to a use-after-free condition in the SiteIsolation component, which occurs when memory is...

CVE-2026-113218

A flaw was found in chromium-browser. A remote attacker can execute arbitrary code inside the sandbox by convincing a user to visit a specially crafted HTML page. This issue is caused by a use-after-free vulnerability within the DataTransfer component...

CVE-2026-113054

An out of bounds read flaw was found in the SiteIsolation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=549529981 https://code.google.com/p/chromium/issues/detail?id=113054...

CVE-2026-98642

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF memory allocator. A race condition occurs when bulk memory allocation and memory cleanup run concurrently without adequate synchronization. A local attacker could exploit this flaw to trigger a use-after-free condition, leading to ...

CVE-2026-98738

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when the Security Manager Protocol SMP accesses remote Out-of-Band OOB pairing data without proper locking while the data is concurrently being removed. A local attacker can exploit this flaw to trigger a...

CVE-2026-98733

A flaw was found in the Linux kernel's Bluetooth subsystem. Inadequate synchronization when handling fragmented isochronous ISO data packets allows a race condition between packet queueing and transmission operations. A local user could exploit this flaw to trigger a use-after-free condition,...

CVE-2026-98737

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user to cause a Denial of Service DoS or potentially escalate privileges due to a use-after-free condition. The issue arises from a race condition where synchronous command routines access inquiry cache entries...

CVE-2026-98708

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user could exploit this flaw to cause a Denial of Service DoS or system instability. During in-place channel context replacement, an old channel context can be freed prematurely while still referenced by its replacement...

CVE-2026-98696

A flaw was found in the Linux kernel's USB serial subsystem. A local user with administrative privileges could exploit this flaw to cause a Denial of Service DoS or memory corruption. During the unloading of a USB serial driver module, drivers are deregistered in an incorrect sequence, allowing...

CVE-2026-98650

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for the s390 architecture. A race condition occurs when storage key management functions process large memory pages that are simultaneously split by another thread. A local user could exploit this timing issue durin...

CVE-2026-113308

A flaw was found in Chromium. This flaw allows a remote attacker to achieve arbitrary code execution inside the browser sandbox by convincing a user to visit a crafted HTML page. The vulnerability is caused by a use-after-free condition—where memory is improperly accessed after being...