CVE-2026-100176

The AIL Framework username timeline feature is vulnerable to stored cross-site scripting (XSS) . The application stores usernames from chats and crawled forums without character restrictions. When an authenticated analyst views the timeline, the client-side JavaScript file var/www/static/js/d3/ti...

CVE-2026-100000

Technical details are not publicly available in the provided documents for CVE-2026-100000 . This candidate has been reserved, and further details have not yet been provided. Action: monitor for updates.

CVE-2026-80431

The kitty terminal (versions 0.40.0 to before 0.49.0 ) contains an out-of-bounds write vulnerability in the natural width branch of the text sizing protocol. The root cause is located in screen_handle_multicell_command() within kitty/screen.c, where the application appends codepoints to a fixed-s...

CVE-2026-100174

The AIL Framework tag selector component (specifically var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of input sanitization for tag names; the application passes the displayField value directly to the jQuery .html() property in both the ...

CVE-2026-100172

The AIL Framework (ail-project/ail-framework) is vulnerable to a stored cross-site scripting (XSS) flaw in two Jinja2 templates: var/www/templates/chats_explorer/block_message.html and var/www/templates/objects/item/show_item.html. The root cause is the interpolation of dynamic values (such as ic...

CVE-2026-80430

The kitty terminal emulator (versions 0.47.0 before 0.49.0 ) is vulnerable to an improper link resolution flaw in its drag and drop protocol. The root cause lies in subdir_data_for_drag() within kitty/dnd.c, which constructs path strings instead of walking the tree component by component. This al...

CVE-2026-98162

The Linux kernel contains a memory leak vulnerability in the smb/server component. Specifically, the smb2_tree_connect() function fails to disconnect a new tree connection when ksmbd_iov_pin_rsp() fails, leading to a leak of the tree_conn object. This issue is categorized as CWE-401 (Missing Rele...

CVE-2026-98161

A flaw exists in the Linux kernel persistent memory (pmem ) subsystem where the pmem_submit_bio() function incorrectly handles REQ_PREFLUSH errors. Specifically, the driver continues to copy bio data even after a preflush failure, potentially overwriting the error with a subsequent successful REQ...

CVE-2026-98160

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...

CVE-2026-100079

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsiregister creates per-instance debugfs entries, but ucsiunregister keeps them around until ucsidestroy. Drivers like ucsiglink that unregister/register the same UCSI...

CVE-2026-100078

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwlmeiwritecyclicbuf should be the cldev but the qhead pointer is passed instead. Fix it...

CVE-2026-100076

A memory leak vulnerability exists in the Linux kernel 's rtl8723bs wireless network driver. The driver fails to release allocated transmission frames and buffers back to their memory pools when encountering specific error paths during management frame handling, such as when a beacon exceeds 512 ...

CVE-2026-100077

A flaw in the Linux kernel's MSM DRM driver allows a Denial of Service (DoS) during GPU recovery operations. The vulnerability occurs because the driver may retire a hung command submission before the hardware recovery is complete, triggering a buffer object (BO) free while the GPU is still acces...

CVE-2026-100075

A vulnerability exists in the Linux kernel within the RDMA/srpt component. Specifically, the function srpt_alloc_rw_ctxs() fails to properly clean up n_rw_ctx and n_rdma values, leaving behind a dangling rw_ctxs pointer when it fails during a multi-buffer indirect descriptor operation. This overs...

CVE-2026-100073

The Linux kernel contains a vulnerability in the ext4 filesystem where transaction credits were insufficient during writeback operations. The root cause is that previous fixes failed to account for cases where extent conversion requires splitting large unwritten extents into multiple small writte...

CVE-2026-100074

The Linux kernel contains a vulnerability where the BPF_REFCOUNT field is not marked as a unique field , which is an oversight that has been addressed in recent updates. This issue affects the bpf subsystem. While the documents confirm the fix and identify the specific component, no information r...

CVE-2026-100072

The Linux kernel contains a vulnerability in the ACPI subsystem where the use of acpi_get_first_physical_node() in acpi_platform_fill_resource() and acpi_create_platform_device() is considered unsafe because the returned device may be freed at any time. The current implementation is also ineffici...

CVE-2026-100071

The Linux kernel contains a vulnerability where the hsr_dev_finalize() function fails to release dynamic nodes learned into the node_db . This occurs because the function can fail after a lower-device RX handler is registered but before completion, allowing frames received during that window to p...

CVE-2026-100070

The Linux kernel contains a vulnerability in netfilter: nf_nat_sip where the rewind offset is incorrectly calculated when Network Address Translation (NAT) shrinks a packet. Specifically, if map_addr() changes the packet length (e.g., a shorter public NAT IP), the coff variable remains relative t...

CVE-2026-97864

A vulnerability exists in GibbonEdu Gibbon (versions up to 30.0.01 ) within the Unit Planner component. Specifically, the makeBlock function in the file modules/Planner/units_add_blockAjax.php fails to perform proper authentication when the gibbonUnitBlockID/mode argument is manipulated. This fla...