Syncplify Server! versions prior to 8.8.0 have an access control bypass vulnerability due to improper resolution of path equivalence. Authenticated SFTP users can bypass per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names, allowing unauthorized file uploads and downloads. This vulnerability is fixed in version 8.8.0.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 9.6 Extended Update Support. These include denial of service, arbitrary code execution via various buffer overflow and use-after-free flaws, data integrity issues due to integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. The update synchronizes release versions across several RHEL releases and addresses these critical security issues.
CVE-2026-115680 is an out-of-bounds read vulnerability (CWE-125) affecting Arm Keil MDK-Middleware versions 8.0.0 through 8.3.0. The flaw involves DHCPv6 Option processing, which may lead to over-reads of memory and unintended data retransmission. The vulnerability has a medium severity with a CVSS score of 6.5. No public exploits or patches are currently documented.
A heap buffer overflow vulnerability exists in the RainerScript replace() function of the rsyslog daemon, which can lead to a denial of service condition. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security update to address this vulnerability.
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
A buffer overflow vulnerability in the Linux kernel's dm-integrity inline mode with large tag sizes has been fixed. The issue occurs because checksum computations use a buffer smaller than the tag size, causing overflow and kernel panic with stack protection enabled. This overflow can only be triggered by root, so it is not considered a security bug.
A vulnerability in the Linux kernel's drm/vc4 driver involves improper handling of the hangcheck timer and job completion work during V3D unbind. The hangcheck timer and job_done_work are not properly stopped or drained before the V3D interrupt is uninstalled and the associated device structure freed. This can lead to timer callbacks accessing freed memory, causing potential use-after-free conditions.
A vulnerability in the Linux kernel related to AMD processors' TLB invalidation has been addressed. The issue involves the processor potentially failing to invalidate a TLB entry when executing an INVLPGB/TLBSYNC instruction pair. A software workaround is applied when a microcode fix is not available to mitigate this erratum.
A vulnerability in the Linux kernel's RISC-V architecture handling of BPF JIT execmem addresses was fixed. The issue involved incorrect assumptions about memory writability in the vmalloc area when CONFIG_STRICT_MODULE_RWX is disabled, causing BPF JIT compilation to fail due to page faults. This bug affects configurations where BPF text is read-only regardless of strict module RWX settings and can prevent BPF programs from being JIT-compiled. The fix aligns with similar corrections made on arm64 and involves proper handling of executable memory mappings in patch_map(). The vulnerability does not affect !CONFIG_MMU builds.
A vulnerability in the Linux kernel's memory management subsystem causes a kernel panic during boot when using a boot-time function tracer with a specific filter. The issue arises because deferred kernel page table freeing is scheduled before the workqueue system is initialized, leading to a null pointer dereference and system crash. The flaw was introduced by a commit that allowed collapsing page tables to free kernel page tables prematurely during early boot. The fix prevents scheduling deferred freeing work while the system is still booting, deferring it until the workqueue is available.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie was fixed by correcting a bounds check on the TX descriptor index. The function btintel_pcie_prepare_tx() previously allowed an index equal to the array size, which is out of bounds, potentially leading to memory access errors.
A vulnerability in the Linux kernel Bluetooth management subsystem caused pending commands flushed on power off to report incorrect success status instead of the actual error status. This could lead to user-space components like bluetoothd misinterpreting the device state, potentially causing crashes.
A vulnerability in the Linux kernel's TEE subsystem allows zero-sized shared memory allocations via tee_dyn_shm_alloc_helper(). This leads to an invalid call to the page allocator, causing allocation failure and potentially a kernel panic during boot on systems with panic_on_warn enabled. The flaw is triggered by TEE_IOC_SHM_ALLOC with a zero size parameter. The issue has been resolved by rejecting zero-sized allocations.
A vulnerability in the Linux kernel's io_uring subsystem allowed disabled rings to bypass task-specific register opcode restrictions. This could enable a task with restricted register opcodes to create a disabled ring, perform any register operation on it, and then enable the ring regardless of the allowed opcode set. The issue has been fixed by ensuring that disabled rings inheriting restrictions from their creating task continue to enforce those restrictions until enabled.
A vulnerability in the Linux kernel's AMDGPU driver involves improper serialization of vblank counter reads against GPU reset operations. During GPU recovery, hardware register reads can occur while a reset semaphore is held for writing, causing lock dependency assertion failures and kernel taint warnings. The fix involves acquiring the reset semaphore for reading before hardware access or returning a cached software count if reset is in progress, preventing unsafe hardware access during reset.
A vulnerability in the Linux kernel's ASoC Samsung i2s driver causes a runtime power management imbalance due to improper clock enablement in the probe function. This leads to a warning during boot related to clock disablement.
Mattermost versions 11.7.x up to 11.7.10 have a vulnerability where outbound internal-connection filtering is not applied to the OpenID discovery endpoint request. This flaw allows a System Administrator to determine if internal addresses and ports are reachable from the server by triggering an unauthenticated login request that initiates the discovery fetch. The issue is classified as low severity with a CVSS score of 2.7.
Mattermost versions 11.7.x through 11.10.x (up to specified patch levels) contain a vulnerability in the WebSocket msgpack decoder where allocation limits are not properly enforced. This flaw allows an authenticated remote attacker to cause excessive server memory allocation by sending a crafted binary WebSocket frame with a large declared Bin32 payload length. The issue leads to a denial-of-service condition due to resource exhaustion.