Threat database

This vulnerability concerns a use-after-free (UAF) flaw in the brcmsmac wireless driver function brcms_free_timer(). It affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided, and there is no indication of known exploitation in the wild.

A vulnerability identified as CVE-2026-98068 affects Microsoft products versions 3.0 and 4.0. The issue involves the net/rds component where the function rds_conn_shutdown() improperly handles concurrent drop operations. No CVSS score or detailed impact information is provided.

CVE-2026-97579 is a vulnerability related to the MediaTek video codec (vcodec) component in Microsoft products, specifically involving the handling of AV1 tile-start copy operations bound to array capacity. The vulnerability affects Microsoft product versions 3.0 and 4.0. No CVSS score or detailed impact information is provided.

This vulnerability concerns the media component in Microsoft products related to Verisilicon and Rockchip AV1 video decoding. It involves improper handling of AV1 frames that exceed the tile capacity, potentially leading to issues in media processing.

A security update for PostgreSQL addresses a vulnerability in the pgvector extension that allows arbitrary code execution via an out-of-bounds write during the IVFFlat index build process. This issue is tracked as CVE-2026-103484 and affects Red Hat Enterprise Linux 9 module postgresql:18. The update is rated as Important by Red Hat Product Security.

CVE-2026-98550 is a vulnerability involving the tipc protocol where invalid and unexpected GRP_ACK_MSG messages are not properly rejected, potentially leading to a bc_ackers underflow condition. The affected Microsoft product versions are 3.0 and 4.0. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-98508 affects Microsoft products version 3.0 and 4.0. It involves a NULL pointer dereference occurring during fence allocation failure in the drm/virtio component. The issue has been published but lacks detailed technical or impact information and no CVSS score is provided.

This vulnerability relates to the drm/nouveau component where the pin count is not incremented properly on a failed re-pin operation in the nouveau_bo_pin_locked() function. The issue affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided, and there is no indication of known exploits in the wild or available patches.

CVE-2026-98643 is a vulnerability in Microsoft software involving an out-of-bounds read of the rtt_min variable in the sock_ops component of the BPF subsystem. The flaw could potentially lead to memory access issues. The affected versions are Microsoft versions 3.0 and 4.0. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild. No patch or remediation details are available from the provided data.

This vulnerability relates to the Bluetooth subsystem in Microsoft products, specifically addressing an issue with the handling of CIS (Connected Isochronous Stream) hold ownership during reuse. The advisory provides no detailed technical information or impact description. The affected versions are exactly 3.0 and 4.0. No CVSS score or exploit information is available.

A use-after-free (UAF) vulnerability exists in the net/smc component during lgr list traversal in the smcr_port_err() function. This issue affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided. No known exploits in the wild have been reported, and no patch or remediation details are available from the vendor advisory.

CVE-2026-98541 is a published vulnerability related to the handling of the FOU_ATTR_IPPROTO attribute in the FOU_ENCAP_DIRECT context within Microsoft software versions 3.0 and 4.0. The provided information does not include details on the nature of the flaw, its impact, or exploitation methods.

This vulnerability relates to an incorrect RCU (Read-Copy-Update) teardown order in the drm/i915 component. The issue affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation in the wild.

This vulnerability involves the HID amd_sfh component where the PCI Base Address Register (BAR) size is not validated before mapping. The issue is identified in Microsoft products, specifically versions 3.0 and 4.0. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-98553 affects Microsoft products version 3.0 and 4.0 related to autofs, specifically a file reference leak in the autofs_kill_sb() function. No detailed impact or exploitation information is provided.

CVE-2026-98590 is a vulnerability related to the bpf_sock context code generation in Microsoft software versions 3.0 and 4.0. The advisory does not provide detailed technical information or impact specifics. No CVSS score or exploit information is available.

A vulnerability identified as CVE-2026-98494 affects Microsoft products version 3.0 and 4.0 related to the 'net: atl1' component. The issue involves a soft lockup caused by an out-of-range read of the cmb_tpd_next_to_clean variable. No CVSS score or detailed impact information is provided.

This vulnerability involves the Bluetooth L2CAP protocol where frame length validation is insufficient before accessing control and Frame Check Sequence (FCS) fields. It affects Microsoft products version 3.0 and 4.0. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.

CVE-2026-98554 is a vulnerability related to VLAN handling in Microsoft software versions 3.0 and 4.0. The issue involves ensuring sufficient headroom in the vlan_dev_hard_header() function. No detailed impact or exploitation information is provided.

A vulnerability identified as CVE-2026-98454 affects Microsoft SMB client versions 3.0 and 4.0, involving out-of-bounds reads in the create context handling. The issue has been publicly disclosed but lacks detailed technical information and a CVSS score. No known exploits are reported in the wild, and no patch or remediation details are provided.