A vulnerability in the Linux kernel's NTFS implementation was fixed where an incorrect Master File Table (MFT) record pointer was passed to the function ntfs_attr_record_resize. This caused incorrect size calculations during memory operations when handling attributes in extent records. The fix involved passing the correct MFT record pointer to the function.
A memory management vulnerability in the Linux kernel's AMDGPU driver causes user pointer ranges to leak when command submission (CS) fails after the parser_bos stage. This leak occurs because certain error paths do not free allocated HMM ranges, resulting in resource leakage including memory and buffer object references. The issue has been fixed in recent Linux kernel commits.
A vulnerability in the Linux kernel scheduler extension (sched_ext) caused a stall when a task enqueued with SCX_ENQ_LAST ended up back on its CPU's local deferred scheduling queue (DSQ). This issue led to CPUs idling with the task queued indefinitely until an unrelated wakeup or watchdog triggered rescheduling. The problem was notably triggered during mass cgroup teardown, causing tasks to be stuck for over 40 seconds. The fix ensures that if a task is left on the local DSQ after enqueueing with SCX_ENQ_LAST, the scheduler sets the need_resched flag to prompt rescheduling.
A vulnerability in the Linux kernel scheduler subsystem was fixed to correct improper handling of bypass dispatch claims among schedulers bypassed by an ancestor. The flaw caused incorrect claim propagation in scheduler bypass depth tracking, leading to potential leaks of bypass dispatch claims and warnings during power management suspend/resume cycles. This fix ensures that every descendant scheduler properly claims and releases bypass dispatches according to their depth changes.
CVE-2026-99103 is a use-after-free vulnerability in the Linux kernel's workqueue subsystem. It occurs due to improper handling of the lifetime of unbound worker pools for pending per-CPU workqueues (pwqs), leading to a potential use of freed memory when activating pending pwqs. The flaw was detected by KASAN and involves a race condition where the pool can be freed while still reachable, causing a use-after-free in node_activate_pending_pwq().
A vulnerability in the Linux kernel's NTFS driver (ntfs_setattr_size) allowed a race condition due to missing exclusive locking around file size updates. This could cause spurious SIGBUS errors during page faults when resizing files. The issue was fixed by adding exclusive invalidate_lock protection during the resize operation.
A vulnerability in the Linux kernel's NTFS implementation involves incorrect handling of attribute record resizing. Specifically, the attribute payload was moved after shrinking its record, causing memory copying errors that lead to malformed mapping pairs arrays. This flaw was fixed in Linux kernel version 7.2.13 by changing the order of operations to move the payload before shrinking the record.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
CVE-2026-101272 is a vulnerability in pretix where the session validation mechanism for API-created shredder exports is incorrect. The same session token is reused for all token-based API users, negating the intended protection. The affected files are referenced by randomly generated UUIDs and exist only for a day, which limits the risk. The issue was similar to a previously fixed flaw but was missed in the fix. The vendor has addressed this by fixing the session validation and hardening related code areas.
CVE-2026-101274 is a vulnerability in pretix's Single-Sign-On (SSO) implementation where the system fails to properly validate the response_type parameter against the configured grant type for an SSO client. This allows an attacker to receive a valid token with an unauthorized response_type if they can run JavaScript on a trusted redirect URI page. The issue affects multiple pretix versions prior to fixed releases in 2026.6.4, 2026.7.3, and 2026.8.1.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including specific LTS releases, contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged remote attacker to perform unauthorized operations. The vulnerability has a high severity score of 7.1 and affects multiple release lines. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.
This article discusses the widespread reliance on security questionnaires in B2B transactions despite their inherent weaknesses. It highlights that these self-assessments are distrusted by those who fill them out but accepted by those who receive them, creating a paradox where trust is based on unverified vendor claims. The piece emphasizes that security questionnaires capture intentions rather than verified controls, contributing to persistent third-party breaches. It advocates for shifting from self-reported answers to observable evidence and independent attestations to establish trust between companies.
A vulnerability in pretix API endpoints allowed unauthorized referencing of gift cards by exploiting predictable internal IDs. Attackers could create payments linked to gift cards from other organizers without charging the gift card, then trigger refunds to increase the gift card's value. This flaw affects multiple versions of pretix prior to fixed releases in 2026.6.4, 2026.7.3, and 2026.8.1.
Cisco has addressed multiple vulnerabilities in its Secure Firewall ASA, Threat Defense, and Management Center products. These vulnerabilities have been grouped into eight different classes, each assigned a unique CVE identifier. No specific technical details, affected versions, or impact information are provided in the available data.
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
CVE-2026-112198 is an XML External Entity (XXE) injection vulnerability in the SAFT import feature of the Tactis NoviGest Desktop App. The vulnerability arises because the application uses a JAXB Unmarshaller to process user-controlled XML files without disabling external entity resolution. This flaw allows an attacker to supply a crafted XML file that can read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed. The vulnerability has a high severity score of 8.3 CVSS v4.0 and requires local access with low privileges to exploit.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a critical severity with a CVSS score of 9.6. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
CVE-2026-112197 is a critical vulnerability in the Tactis NoviGest Desktop App caused by missing authentication in its Java RMI service. This flaw allows attackers with network access to invoke remote methods without authentication, leading to unauthorized access to sensitive credentials and the ability to execute arbitrary SQL queries on the PostgreSQL database. The database account's elevated privileges enable attackers to chain these actions to execute operating system commands on the server, severely compromising confidentiality, integrity, and availability.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution.