CVE-2026-74627

A flaw was found in the Linux kernel's net: devmem component. This vulnerability occurs when netiov and page-backed fragments are improperly mixed within a single skb socket buffer in the zerocopyfillskbfromdevmem function. This improper handling can lead to a system crash, resulting in a Denial ...

CVE-2026-74623

A flaw was found in the Linux kernel's atlantic network driver. When a network interface using this driver is deinitialized while under transmit TX or XDPTX load, certain transmit buffers are not properly released. This oversight leads to a memory leak, which can prevent the proper shutdown of...

CVE-2026-74620

A flaw was found in the Linux kernel's net/sched subsystem, specifically within the actgact and actpolice modules. A local user could exploit this vulnerability by providing a specially crafted control action that bypasses proper range checks. This improper handling of control actions leads to an...

CVE-2026-58314

A flaw was found in Gitea. This vulnerability, known as Server-Side Request Forgery SSRF, allows an attacker to trick the server into making requests to internal network resources. A logged-in user can exploit this by crafting malicious webhooks or repository migration configurations, leading to...

CVE-2026-74630

A flaw was found in the Linux kernel's IPv6 subsystem. The in6devget function can incorrectly increment the reference count of an inet6dev object after it has been freed, leading to a use-after-free vulnerability. A local attacker could exploit this to cause memory corruption, potentially resulti...

CVE-2026-63639

A flaw was found in Valkey, a distributed key-value database. A remote attacker could exploit a use-after-free vulnerability in the RESTORE command. This occurs when a malformed data stream is processed during stream deserialization, causing a shared resource to be improperly managed. If...

CVE-2026-58081

A flaw was found in iconv. Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly validate the size of the provided output buffer before writing converted characters. This oversight could allow an application using iconv to convert untrusted input with one of the affected...

CVE-2026-56684

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...

CVE-2026-75904

A flaw was found in libmodplug. An out-of-bounds read vulnerability exists in the patsmplooped function when processing a specially crafted MIDI Musical Instrument Digital Interface file. This flaw occurs because the function incorrectly handles a sample index, leading to a read one byte before a...

CVE-2026-74637

A flaw was found in the Linux kernel's perf subsystem. A local attacker could exploit a use-after-free vulnerability when a perf event group's sibling is detached but remains active, and its pointer to the group leader is not properly updated. This improper handling can lead to a system crash,...

CVE-2026-74636

A flaw was found in the Linux kernel. A race condition exists between the updateeventfields and eventdefinefields functions within the tracing subsystem. A local user, by loading specific modules, could exploit this unprotected access to kernel fields. This could lead to a kernel panic, resulting...

CVE-2026-74618

A flaw was found in the Linux kernel's binfmtmisc component. An unprivileged local user can exploit this vulnerability by manipulating user and mount namespaces to repeatedly trigger a warning condition during the mounting of binfmtmisc. This repeated triggering can lead to kernel log flooding,...

CVE-2026-74619

A flaw was found in the Linux kernel's overlay filesystem overlayfs. An unprivileged local user can repeatedly trigger a warning condition by manipulating user and mount namespaces and file system context operations. This can lead to kernel log flooding, kernel tainting, and potentially a system...

CVE-2026-65610

A flaw was found in nnn. This vulnerability arises from a numeric truncation error where the system incorrectly handles HOME path lengths exceeding 255 characters. An attacker, by manipulating the victim's execution environment, can provide a specially crafted HOME path. This manipulation causes...

CVE-2026-65609

A flaw was found in nnn. Due to insufficient validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who can place a malicious...

CVE-2026-62377

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a specially crafted HEIF sequence. Processing this malicious file could lead to a reachable assertion or dereference an empty map, resulting in a crash of the application. This...

CVE-2026-62291

A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image formats. A remote attacker could exploit this vulnerability by providing a specially crafted image sequence with mismatched auxiliary alpha dimensions. During the image processing workflow, this could lead to...

CVE-2026-55648

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. An integer overflow vulnerability in the freerdpimagecopyfromicondata function allows a malicious Remote Desktop Protocol RDP server to bypass a bounds check. By sending a specially crafted icon update with large...

CVE-2026-55564

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the glyphcacheget function. By sending crafted glyph fragments, the server can cause the client to read beyond the intended memory buffer. This can lead to a client crash...

CVE-2026-76879

A flaw in Wireshark's C12.22 protocol dissector allows remote attackers to trigger a Denial of Service DoS. By sending a specially crafted network packet or capture file, an attacker can crash the application, disrupting network analysis capabilities. Mitigation Avoid analyzing capture files or...

CVE-2026-74616

A flaw was found in the Linux kernel's XDP eXpress Data Path component. When XDP frames are cloned, a specially crafted frame can cause the skbsharedinfo structure to overwrite live packet data. This improper handling of memory during frame cloning can lead to corruption of XDP return metadata,...

CVE-2026-65612

A flaw was found in nnn. An attacker can exploit this vulnerability by placing a file with a specially crafted name, containing shell syntax, on a shared filesystem, removable media, or within an extracted archive. If a victim then navigates to and opens this file using the preview-tabbed feature...

CVE-2026-62292

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could craft a malicious HEIF image that, when processed by an application decoding an advertised tile, could lead to an out-of-bounds read. This vulnerability occurs due to an integer overflow during...

CVE-2026-65611

A flaw was found in nnn, a file manager. This vulnerability, known as Shell Command Injection, allows an attacker to execute arbitrary commands. By creating a specially crafted directory name containing shell syntax on a shared filesystem, removable media, or within an extracted archive, an...

CVE-2026-62289

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a specially crafted HEIF or AVIF file containing a clean aperture box. This can lead to an integer underflow when processing image transformations, causing...

CVE-2026-55193

A flaw was found in FreeRDP. FreeRDP clients using TS Gateway are vulnerable to a heap-buffer-overflow. A malicious gateway can send a specially crafted response fragment, causing the client to write beyond its allocated buffer. This can lead to a client crash, resulting in a Denial of Service Do...

CVE-2026-55191

A flaw was found in FreeRDP. FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend are vulnerable to a heap-buffer-overflow. A malicious Remote Desktop Protocol RDP server can supply crafted surface dimensions, causing an undersized buffer to be allocated. This can lead to a...

CVE-2026-52834

A flaw was found in jxl-grid, a pure Rust implementation of a JPEG XL decoder. On 32-bit platforms, decoding a specially crafted JPEG XL image can lead to an integer overflow in length calculations. This overflow can cause the allocation of a smaller buffer than required, enabling...

CVE-2026-50142

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker can provide a specially crafted HEIF sequence that triggers an unbounded heap allocation. This occurs because the HEIF sequence parser's fixed-size mode is missing a bound check, and an integer...

CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-74705

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

CVE-2026-74658

A flaw was found in the Linux kernel's futex subsystem. A race condition during robust futex unlock operations can occur when a process waiting on a futex is killed before it can acquire the futex, and another process subsequently re-acquires the futex through a fast path. This can lead to a...

CVE-2026-74612

A flaw was found in the Linux kernel's veth component. A remote attacker could exploit incorrect packet buffer skb length accounting after an eXpress Data Path XDP fragment adjustment. This could lead to the disclosure of sensitive kernel memory information to userspace and corruption or truncati...

CVE-2026-74609

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication protocol implementation. A race condition exists in the tipcnodelinkdown function where a link pointer is cached without proper locking. This allows another process to free the link object while the cached pointer...

CVE-2026-45698

A flaw was found in Netatalk. A stack-based buffer overflow in the deletedir function of the afpd daemon can be exploited by a remote attacker. This occurs due to an integer underflow during path construction, which allows attacker-controlled filenames to be copied into a stack buffer without...

CVE-2026-74611

A flaw was found in the Linux kernel's Transport Layer Security TLS 1.3 implementation. When processing TLS 1.3 records with optimistic zero-copy enabled, the tlsdecryptsg function fails to properly restore the message iterator during a retry. A remote attacker, by sending a specially crafted TLS...

CVE-2026-74692

A flaw was found in the Linux kernel's net/smc component. A time-of-check to time-of-use TOCTOU race condition allows a remote attacker to exploit a window where the listener's state is checked without proper locking. By opening TCP connections while the server is closing, an attacker can cause a...

CVE-2026-74681

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. An incorrect buffer size validation occurs in the usbiobulkmsg function, where the bulk IN receive buffer size is mistakenly compared against the bulk OUT endpoint size instead of the actual receive buffer...

CVE-2026-74660

A flaw was found in the Linux kernel's netfilter: ebtnflog component. This vulnerability occurs because the ebtnflog module does not properly manage references to the nfnetlinklog module. An attacker with the ability to configure ebtables rules could exploit this by causing an ebtables nflog rule...

CVE-2026-74642

A flaw was found in the ALSA USB MIDI2 EPs component of the Linux kernel. This use-after-free UAF vulnerability occurs due to a delayed release of MIDI2 endpoints, leading to an attempt to dereference an already freed Universal MIDI Packet UMP endpoint object. An attacker could potentially exploi...

CVE-2026-74635

A flaw was found in the Linux kernel's fbdev subsystem, specifically within the bitcursor function. A local user can exploit this vulnerability by writing arbitrary values to the /dev/vcsa device or by manipulating font changes. This improper handling of glyph indices can lead to an out-of-bounds...

CVE-2026-74617

A flaw was found in the Linux kernel's dibs device driver. The dibs-lock was not properly initialized when a dibs device was allocated, allowing a Global ID GID event interrupt to occur before the lock was ready. This could lead to the system attempting to acquire an uninitialized lock, potential...

CVE-2026-74610

A flaw was found in the Linux kernel's Transport Layer Security TLS implementation. An unprivileged local user could trigger a kernel null pointer dereference by sending specific data on a loopback TCP socket with the TLS Upper Layer Protocol ULP attached. This vulnerability occurs because the TL...

CVE-2026-74608

A flaw was found in the Server Message Block SMB client of the Linux kernel. A use-after-free vulnerability exists in the cifstryaddingchannels function. This occurs when a concurrent interface list refresh removes a reference to an interface while a channel creation is in progress and fails,...

CVE-2026-74604

A flaw was found in the Linux kernel's thermal/drivers/hwmon component. A use-after-free vulnerability was introduced in the thermaladdhwmonsysfs function due to the removal of a valid check in an error handling path. This flaw could allow a local attacker to cause a denial of service or...

CVE-2026-74603

A flaw was found in the Linux kernel's ptp: ocp module. This vulnerability occurs because the EEPROM board ID, a fixed-size field, is not guaranteed to be null-terminated. When this ID is processed as a C string, it may lead to an over-read beyond its intended memory boundary. This memory...

CVE-2026-74602

A flaw was found in the Linux kernel's ring-buffer component. The rballocatecpubuffer function failed to initialize the bpage-order value, leaving it as zero. This uninitialized value is later used by freebufferpage when deallocating ring-buffers with sub-buffers larger than a page size. An...

CVE-2026-74600

A flaw was found in the Linux kernel's memory management, specifically within the pagetablecheck functionality. An unprivileged local attacker could exploit this by populating a sufficient number of zero mappings. This action could lead to an overflow in the filemapcount, triggering a kernel pani...

CVE-2026-74598

A flaw was found in the Linux kernel's IPv6 networking stack. An off-by-one error in the validation of the Route Information option length RFC 4191 allows a remote attacker to craft a Router Advertisement RA packet. This crafted packet can cause the kernel to read up to 8 bytes beyond the intende...

CVE-2026-74596

A flaw was found in the Linux kernel's fsverity subsystem. The vulnerability is due to the removal of a check in the setattrprepare function, which previously verified if fs-verity was enabled. This change allows fsverity files to be truncated even when the fs-verity feature is not active on the...