CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. Mitigation Restrict network access...

CVE-2026-74402

A flaw was found in the Linux kernel's atmel-sha204a cryptographic hardware random number generator HWRNG driver. Improper buffer management in both blocking and non-blocking paths causes the driver to fail in providing valid entropy. This occurs because the buffer is read starting from byte 1, a...

CVE-2026-74360

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. The bpfmapelem iterator does not properly enforce exclusivity checks for certain maps, allowing it to bind to an exclusive map. This oversight exposes the map's value as a writable buffer. A local attacker could leverage...

CVE-2026-74355

A flaw was found in the Linux kernel's iommu/vt-d component. This vulnerability occurs when the info-node RB-tree member is zero-initialized, and a device that does not support Address Translation Services ATS skips the devicerbtreeinsert call. If a subsequent probe step fails, the error path...

CVE-2026-74305

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. This vulnerability allows a program without cgroup storage to bypass compatibility checks when bridging tail call chains. This could enable unintended interactions between programs with and without cgroup storage,...

CVE-2026-74281

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. A remote attacker, acting as a peer node, could exploit this by sending specially crafted PUBLICATION messages with inverted service ranges. This oversight in validating service range bounds allows the...

CVE-2026-70907

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle...

CVE-2026-70906

Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

CVE-2026-74270

A flaw was found in the Linux kernel's handshake mechanism. An unprivileged local attacker can exploit a missing permission check in the 'DONE' command of the handshake general Netlink genl family. By guessing or observing a valid socket identifier, the attacker can either force the kernel to...

CVE-2026-74337

A flaw was found in the Linux kernel, specifically within the BPF Berkeley Packet Filter subsystem. This vulnerability allows NMI Non-Maskable Interrupt and tracepoint BPF programs to re-enter certain internal locks, known as LRU Least Recently Used locks, while they are already held. This re-ent...

CVE-2026-74258

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A missing bounds check when accessing user space data for uprobemulti could allow a local attacker to read or write to memory outside of intended boundaries. This vulnerability can lead to information disclosure or...

CVE-2026-74416

A flaw was found in the Linux kernel's drm/radeon component. When a Graphics Processing Unit GPU reset operation fails to acquire a necessary lock, a memory buffer is not properly released. Repeated occurrences of this issue can lead to a gradual depletion of kernel memory. This memory exhaustion...

CVE-2026-74256

A flaw was found in the Linux kernel, specifically within its BPF Berkeley Packet Filter and sockmap features. This vulnerability is due to an integer overflow in the bpfmsgpopdata function, where certain calculations can incorrectly wrap around. An attacker with local access could exploit this b...

CVE-2026-60589

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-76045

A flaw was found in WebGL in Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a high-severity security risk...

CVE-2026-53785

A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory. Mitigation To mitigate this issue, avoid using the rsync --relative -R option when synchronizing with untrusted senders...

CVE-2026-74261

A flaw was found in the ALSA Advanced Linux Sound Architecture sequencer component of the Linux kernel. A local attacker could exploit a race condition during the FIFO First-In, First-Out resize operation. This vulnerability allows stale data cells to persist, preventing the proper deallocation o...

CVE-2026-74330

A flaw was found in the Linux kernel's configfs component. This vulnerability arises from improper handling of directory traversals, where cursors can be unexpectedly moved or freed by another process even when the parent directory is locked. This lack of proper synchronization can lead to an...

CVE-2026-74320

A flaw was found in the fbdev: sm501fb component of the Linux kernel. The code responsible for obtaining frame buffer mode information from Open Firmware OF binding contains multiple memory handling errors. These include use-after-free vulnerabilities, buffer overruns when writing mode strings...

CVE-2026-66273

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of...

CVE-2026-66257

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

CVE-2026-74382

A flaw was found in the Linux kernel's clsbpf component, which handles traffic control filtering. A local attacker could exploit this vulnerability by triggering a specific sequence of failures during an offload rollback operation. This leads to an unbounded recursion, causing a stack overflow an...

CVE-2026-74399

A flaw was found in the Linux kernel's Extended Verification Module EVM. The evmreadxattrs function, when processing extended attributes, fails to properly initialize a buffer. This can lead to an out-of-bounds read when no extended attributes are configured, potentially allowing an attacker to...

CVE-2026-74357

A flaw was found in the drm/amdgpu component of the Linux kernel. This vulnerability involves a race condition during the processing of GPU ring data within the amdgpucoredump function. This can lead to a memory corruption issue, specifically a slab-out-of-bounds write. A local attacker could...

CVE-2026-74311

A flaw was found in the Linux kernel. During a system restore operation, the virtio real-time clock RTC component fails to properly manage virtual queues virtqueues. If the reinitialization of these virtqueues fails, the system attempts to delete queues using incorrect memory references. This can...

CVE-2026-74426

A flaw was found in the Linux kernel's AFS Andrew File System component. A local user can exploit this by triggering a specific memory allocation condition during a mount operation, leading to a null pointer dereference. This can cause the system to crash, resulting in a Denial of Service DoS...

CVE-2026-74318

A flaw was found in the Linux kernel's btrfs filesystem. A local user could trigger a deadlock when cloning an inline extent with the flushoncommit mount option, specifically when the destination offset is greater than zero. This issue occurs due to a missing isize update during the copy operatio...

CVE-2026-74271

A flaw was found in the Linux kernel's power supply core component. When the device tree dts property power-supplies has multiple values, an array overrun can occur in the powersupplypopulatesuppliedfrom function due to incorrect memory allocation. This vulnerability could lead to memory...

CVE-2026-74321

A flaw was found in the btrfs file system component of the Linux kernel. This vulnerability occurs in the btrfsrundelayedrefs function when an error condition is not properly handled, leading to an invalid pointer dereference. A local attacker could potentially exploit this flaw to cause a system...

CVE-2026-74334

A flaw was found in the RDMA/nldev component of the Linux kernel. Improper locking during memory region re-registration reregmr can lead to a race condition when accessing protection domains PD. This vulnerability could result in unpredictable system behavior or a denial of service due to...

CVE-2026-74414

A flaw was found in the Linux kernel's HFS Plus hfsplus filesystem. A local user could trigger a null-pointer dereference by executing the setxattr function in userspace when the attributes file is not properly loaded during system mount. This vulnerability is caused by a duplicate attribute inod...

CVE-2026-74406

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN component. A race condition can occur where the udptunnelsockrelease function sets a socket's user data to NULL while the vxlangropreparereceive function is still actively using it. This could lead to a null pointer dereference,...

CVE-2026-74276

A flaw was found in the Linux kernel's spi: xilinx driver. The driver incorrectly determines the size of its internal buffer, a First-In, First-Out FIFO queue. This miscalculation can lead to an overflow when the driver attempts to write more data than the FIFO can hold during a Serial Peripheral...

CVE-2026-74301

A flaw was found in the Linux kernel's Bluetooth driver. An error in handling Bluetooth packets can cause a memory leak, where a data structure is not properly released. This continuous leakage of memory could potentially lead to system instability or a denial of service...

CVE-2026-74362

A flaw was found in the Linux kernel's ext2 filesystem. When performing write operations on files opened with OSYNC or ODSYNC flags, the system call write2 could incorrectly report success to a local user even if the data synchronization to disk failed. This could lead to data integrity issues, a...

CVE-2026-74380

A flaw was found in the Linux kernel's host1x GPU driver. An incorrect return value check in the iommumapsgtable function, coupled with an improper integer assignment in pinjob, could lead to negative value overflows. This vulnerability may result in data integrity issues or system instability...

CVE-2026-74373

A flaw was found in the Linux kernel's md/raid1 and raid10 components. This flaw involves incorrect accounting of block I/O bio operations for split cloned bios. When a failed bio is split and resubmitted, the system may either double count or miss accounting for these bios. This can lead to...

CVE-2026-74372

A flaw was found in the Linux kernel's RAID1 subsystem. When a REQATOMIC write operation encounters a bad block, a reference to the RAID device rdev is not properly released. This resource leak prevents the affected RAID device from being removed, potentially leading to a denial of service DoS...

CVE-2026-74354

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local attacker could exploit a locking issue within the zappages function. This vulnerability arises because zapvmarange requires a specific memory map lock mmaplock that, when acquired under certain conditions, can le...

CVE-2026-74369

A flaw was found in the Linux kernel's liveupdate component. This use-after-free vulnerability occurs due to an incorrect order of operations when managing file handler modules. Specifically, the system attempts to access module operations after the module's reference count has been decremented,...

CVE-2026-74293

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture System on Chip ASoC subsystem, specifically within the fslaudmix component. The fslaudmixputmixclksrc and fslaudmixputoutsrc functions do not properly validate user-provided enum values before processing them. This improper...

CVE-2026-74437

A flaw was found in the Linux kernel's uvcvideo module, which manages USB Video Class UVC devices. When a UVC camera with asynchronous control is in use, a specific sequence of operations can lead to a deadlock within the kernel. This vulnerability could allow a local attacker to cause a...

CVE-2026-74309

A flaw was found in the Linux kernel's vdpa/octeonep component. This vulnerability involves an incorrect mapping of Interrupt Request IRQ numbers to processing rings within the interrupt handler. The system incorrectly calculates the IRQ index, which can lead to misdirected or mishandled...

CVE-2026-76166

A flaw was found in modcluster's AdvertiseListenerImpl org.jboss.modcluster core module. A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest that is...

CVE-2026-76042

A flaw was found in Google Chrome, specifically within its GPU component, where an uninitialized resource could be used. A remote attacker, after compromising the renderer process, could exploit this by crafting a malicious HTML page. This could allow the attacker to read memory outside of the...

CVE-2026-74427

A flaw was found in the AFS Andrew File System component of the Linux kernel. During the teardown of an AFS network namespace, a work item responsible for managing preallocated resources rxrpc call/connection/peer queue may not be properly canceled. This improper resource handling could lead to a...

CVE-2026-74420

A flaw was found in the Linux kernel's GPU Shared Virtual Memory SVM subsystem. This vulnerability occurs when attempting to create an SVM range on Virtual Memory Areas VMAs that are not backed by physical page objects. An attacker could exploit this by triggering repeated page retrieval failures...

CVE-2026-74405

A flaw was found in the Linux kernel. A race condition exists within the Optimized Power Performance OPP subsystem, where a newly added OPP object is exposed before its internal reference count is fully initialized. A concurrent operation can then increment this uninitialized reference count,...

CVE-2026-74319

A flaw was found in the btrfs zoned filesystem within the Linux kernel. When performing data relocation, the system can enter a deadlock state. This happens because the relocation process waits for a space reservation ticket that cannot be fulfilled, as the relocation itself is the operation...

CVE-2026-76034

A flaw was found in Chromium's WebGL component. A remote attacker could exploit a buffer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution outside the sandbox, allowing the attacker to gain control over the affected syste...