CVE-2026-43271 is a medium-severity vulnerability in the Linux kernel's md-cluster component. It involves a NULL pointer dereference in the process_metadata_update() function due to a race condition during the MD array startup sequence. If a METADATA_UPDATED message is received before the main MD thread is initialized, the kernel may panic. The issue is fixed by validating the thread pointer and safely ignoring update requests when the array is not ready.
A memory leak vulnerability was fixed in the Linux kernel's io_uring subsystem related to sgtable not being freed on mapping failures. This occurs in a rare scenario on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machines when io_populate_area_dma() fails, causing an initialized sgtable to remain allocated. The issue was due to an error path that did not properly clean up the allocated table.
CVE-2026-43041 addresses a memory leak vulnerability in the Linux kernel's qrtr subsystem. The issue arises from the use of the deprecated radix_tree API for managing qrtr_tx_flow, where intermediate nodes may remain orphaned and unreclaimed if memory allocation fails during tree construction. The vulnerability is fixed by migrating from radix_tree to the xarray API, which properly cleans up internal nodes, preventing memory leaks.
A memory leak vulnerability was identified and fixed in the Linux kernel's rtl8723bs staging driver. The issue occurred because the function cfg80211_inform_bss_frame() could return NULL on failure, causing an allocated buffer to not be freed properly. This could lead to resource exhaustion over time. The fix ensures that the allocated buffer is freed on both success and failure paths.
CVE-2026-43227 is a medium-severity vulnerability in the Linux kernel's sh_tmu clocksource/clockevent driver. The issue arises because the driver attempts to manage power and clock states while holding raw spinlocks, which conflicts with runtime power management calls that use regular spinlocks. This leads to lockdep warnings and invalid wait context bugs, particularly in PREEMPT_RT builds where normal spinlocks can sleep. The vulnerability does not affect non-PREEMPT_RT builds significantly. The fix involves always leaving the device powered and clocked on after probe to avoid these locking conflicts.
CVE-2026-43043 is a medium severity vulnerability in the Linux kernel's AF_ALG crypto interface. It involves a NULL pointer dereference caused by improper handling of the end marker in a scatter/gather list (SGL) when chaining new af_alg_tsgl structures. This flaw can lead to a kernel panic during the crypto scatterwalk operation.
A vulnerability in the Linux kernel's pvrusb2 driver caused a URB (USB Request Block) leak when a write URB was submitted successfully but the subsequent read URB submission failed. This led to attempts to resubmit an active URB, triggering warnings and potentially causing resource leaks. The issue has been fixed by ensuring the write URB is properly unlinked and waited upon if the read URB submission fails.
CVE-2026-31754 is a medium severity vulnerability in the Linux kernel's cdns3 USB gadget driver. The issue arises when the gadget initialization fails, leaving the hardware in gadget mode while the software state remains inactive, causing a state inconsistency. This inconsistency violates the DRD controller design specification and can lead to a synchronous external abort crash in the xHCI host controller during role switching.
A vulnerability in the Linux kernel NFC driver for the pn533 device allowed the UART receive buffer to grow indefinitely when receiving malformed UART traffic without valid PN532 frame headers. This could lead to a denial of service by exhausting kernel memory. The issue was fixed by bounding the receive buffer and dropping accumulated partial frames once the buffer is full.
CVE-2026-31753 is a medium severity vulnerability in the Linux kernel's auxdisplay line-display subsystem. It involves a NULL pointer dereference in the linedisp_release() function caused by improper retrieval of the enclosing linedisp structure when the attachment list is empty or removed. This can lead to a kernel crash (denial of service).
A command injection vulnerability exists in In Progress® Telerik® UI for WinUI versions prior to 2025 Q1 (3.0.0) due to improper neutralization of hyperlink elements. This flaw allows an attacker with local access and user interaction to execute arbitrary commands, potentially leading to full system compromise. The vulnerability has a high severity score of 7.8 CVSS v3.1. No specific affected versions or patch information is provided in the data.
Electerm versions 3.8.15 and earlier contain a critical vulnerability where the terminal hyperlink handler passes clicked URLs directly to shell.openExternal without validating the protocol. This allows an attacker who controls terminal output to execute arbitrary code or access local files if the victim clicks a malicious link. No patches are publicly available at the time of disclosure.
Kimai versions prior to 2.54.0 contain an authorization flaw in the Team API endpoints. The flaw arises because the code uses #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing the Symfony TeamVoter to abstain from enforcing entity-level ownership checks. This allows any user with the edit_team permission to modify any team, including those they are not authorized to manage. The issue is fixed in version 2.54.0.
A cross-site scripting (XSS) vulnerability exists in locize client SDK versions prior to 4.0.21. The vulnerability arises because the SDK's message event handler does not validate the origin of postMessage events, relying instead on a sender value within the message payload that can be controlled by an attacker. This allows a malicious web page embedded or embedding a locize-enabled host to send crafted messages that trigger internal handlers, potentially leading to script injection. The issue is fixed in version 4.0.21.
MapServer versions from 6.0 up to but not including 8.6.2 contain a reflected cross-site scripting (XSS) vulnerability in the WMS server component. This flaw allows unauthenticated attackers to inject arbitrary HTML or JavaScript into the browsers of users who open specially crafted WMS URLs. The vulnerability arises when using FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. The issue is fixed in version 8.6.2.
A vulnerability in GoBGP v4.4.0 through v4.4.x allows an unauthenticated remote BGP peer to cause a denial of service by sending a malformed BGP UPDATE message. The malformed message triggers a nil pointer dereference in the AdjRib.Update function, causing the GoBGP process to crash and resulting in loss of service availability. This issue is fixed in version 4.5.0.
A server-side request forgery (SSRF) vulnerability exists in monetr's Lunch Flow integration in versions prior to 1.12.5. This flaw allows any authenticated user on a self-hosted instance with default settings to make the server issue HTTP GET requests to arbitrary URLs. The vulnerability arises because the URL validator does not block internal or cloud metadata addresses, and the server reflects response bodies from non-200 HTTP responses in API error messages. This can expose sensitive internal resources, including cloud instance metadata. Additionally, an attacker can cause a denial-of-service by triggering large response bodies to be buffered in memory. The hosted monetr service is not affected as Lunch Flow is disabled by default. The issue is fixed in version 1.12.5.
A remote Denial of Service (DoS) vulnerability exists in GoBGP versions prior to 4.3.0. It is triggered by a malformed BGP UPDATE message containing improperly ordered AS4_PATH and AS_PATH attributes, causing a runtime panic due to an out-of-bounds slice access. This crash leads to the GoBGP process terminating, resulting in loss of routing capabilities.
A remote Denial of Service (DoS) vulnerability exists in GoBGP versions 4.3.0 up to but not including 4.4.0. The flaw is caused by a nil pointer dereference when the daemon processes a malformed BGP UPDATE message containing an unrecognized Path Attribute marked as "Well-known." This leads to a panic and crash of the GoBGP daemon, disrupting BGP session handling.
October Rain CMS has a server-side information disclosure vulnerability in its INI settings parser due to environment variable interpolation via the `${}` syntax in `parse_ini_string()`. Attackers with Editor access can inject environment variable references like `${APP_KEY}` or `${DB_PASSWORD}` into CMS page settings, causing sensitive environment variables to be exposed when the page is reopened. This vulnerability requires authenticated backend Editor permissions and is relevant only when `cms.safe_mode` is enabled. The issue has been patched in versions 3.7.14 and 4.1.10.