A vulnerability in the Linux kernel's Thunderbolt driver allows access to a DisplayPort (DP) tunnel after its DPRX read operation was canceled. This occurs because the code checks a cancellation flag without proper locking, leading to callbacks on tunnels that have already been torn down during system suspend or disconnect. The issue has been fixed by adding proper locking and flag management to prevent accessing inactive tunnels.
A vulnerability in the Linux kernel's fbnic driver related to handling maximum standalone channels has been resolved. The issue arises because the allocation path for NAPI vectors excludes the maximum number of Tx queues, leading to NULL entries that are dereferenced during resource setup in configurations with 64 Tx and 64 Rx queues. This could cause instability or crashes. The fix includes properly accounting for the maximum vector count in standalone allocation.
A vulnerability in the Linux kernel's fbnic network driver involves incorrect use of the Rx queue NAPI pointer to find the NAPI vector. The issue arises when standalone Tx vectors are present, causing the Rx queues to incorrectly point to Tx NAPI vectors. This can lead to improper queue management and potential instability. The flaw has been fixed by using the correct stored napi pointer in netdev_rx_queue.napi, ensuring proper queue handling under the netdev instance lock.
A vulnerability in the Linux kernel's USB CATC driver (catc_rx_done function) allowed crafted packet headers to cause out-of-bounds reads and processing of runt packets. This was due to improper bounds checking of RX packet lengths, which could lead to reading uninitialized memory. The issue has been fixed by properly validating packet lengths and rejecting malformed packets.
A vulnerability in the Linux kernel Bluetooth BNEP implementation allows out-of-bounds reads on short RX/TX frames and incorrect control flow due to control fallthrough. The issue affects the processing of BNEP frames and Ethernet headers, potentially leading to heap reads beyond buffer boundaries and information leaks on short AF_PACKET TX frames. The flaw has been fixed in specific Linux kernel commits.
A vulnerability in the Linux kernel's BPF sock context code generation was fixed. The issue involved incorrect handling of the rx_queue_mapping field, where the code used 64-bit moves that caused sign extension and resulted in runtime values exceeding verifier assumptions. The fix ensures proper use of 32-bit move instructions and correct size reporting for the bpf_sock field.
A vulnerability in the Linux kernel NFC driver for the PN533 chip (CVE-2026-98575) allows an out-of-bounds (OOB) read in the function pn533_acr122_is_rx_frame_valid(). This occurs because the driver reads the frame->ccid.datalen field from a USB response frame without proper bounds checking, potentially causing it to read outside the allocated buffer. The issue is fixed by bounding datalen against the maximum ACR122 frame size and rejecting invalid datalen values.
A vulnerability in the Linux kernel's stmmac network driver was fixed by clearing a stale buffer page pointer after a failed skb build. The issue involved a stale pointer to a recycled page, which could cause inconsistent buffer lifecycle handling in the RX descriptor processing.
A use-after-free vulnerability in the Linux kernel's nfp driver related to IPsec RX state handling has been fixed. The issue occurs because the XArray lock is released before taking a reference to the xfrm_state, allowing the state to be deleted and its reference count to drop to zero. This can lead to attempts to increment a zero reference count after the state is queued for destruction. The fix ensures the reference is taken before releasing the XArray lock to prevent this race condition.
A vulnerability in the Linux kernel's NFC driver for the trf7970a device causes improper power down on startup when an RX gain register read or write fails. This leads to an unbalanced power state due to failure to undo device power-up, potentially causing resource mismanagement.
Vikunja versions 2.3.0 up to but not including 2.7.0 have a session validation vulnerability where WebSocket access can persist after session revocation. This occurs because the handleAuth function does not verify the JWT sid claim against the sessions table. As a result, attackers with a stolen access token can maintain WebSocket connections and continue receiving notifications even after the session is deleted or TOTP enrollment occurs.
CVE-2026-68498 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.16.0 onward. It involves uncontrolled resource consumption due to improper enforcement of the maxNameLength constraint when parsing JSON property names from character-based inputs (e.g., String, Reader, char[]). This allows an attacker to cause excessive memory allocation, potentially exhausting heap memory and crashing the process. Byte-input parsers are not affected. The issue arises because the name length check is delayed until after a large buffer allocation, exceeding the intended limit. No authentication is required, and the default configuration is vulnerable.
CVE-2026-102834 is an integer overflow vulnerability in the IPCameraFrameGrabber component of bytedeco javacv prior to version 1.5.14. The flaw occurs when doubling a 32-bit buffer capacity without checking for overflow or bounding the Content-Length header in an MJPEG stream. A malicious or tampered MJPEG stream can trigger this condition, causing the frame-grabbing thread to enter a permanent CPU-spinning loop, resulting in a denial of service. The issue is fixed in version 1.5.14.
The npm package 'parxleys' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the system. Immediate removal of the package is recommended, but due to the potential extent of the compromise, removing the package alone may not eliminate all malicious software. All secrets and keys stored on the affected computer should be rotated from a separate, secure machine.
Z.ai ZCode version 3.11.2.6792 has a vulnerability where it automatically connects to MCP servers specified in a repository's workspace configuration. This behavior may allow attackers to execute arbitrary code by opening a specially crafted repository. The vulnerability has a high severity rating with a CVSS score of 7.8, indicating significant potential impact on confidentiality, integrity, and availability.
YOURLS versions prior to 1.10.5 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server. This occurs because URL sanitization functions do not properly filter filesystem path traversal sequences, enabling attackers to bypass restrictions and execute code without credentials. The vulnerability can be exploited by requesting crafted URLs containing '../' sequences, leading to remote code execution if a malicious PHP file is present on the server.
Sparx Systems Enterprise Architect version 17.1 is affected by an XML External Entity (XXE) injection vulnerability in its XSLT Debugger feature. This flaw allows processing of external entities from crafted XML files containing a DOCTYPE with external DTD references, enabling an attacker to read arbitrary files on the victim's filesystem. The vulnerability has a high severity with a CVSS 4.0 score of 8.2. Attempts to contact the vendor for remediation information were unsuccessful, and no patch information is currently available.
CVE-2026-16436 is a critical vulnerability in Mitsubishi Electric Corporation's GENESIS and related products involving a weak password recovery mechanism. The challenge response used to unlock the system is fixed and common to all users, allowing a remote attacker to bypass authentication. This vulnerability affects multiple versions of GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. Exploitation could lead to unauthorized disclosure, tampering, destruction, or deletion of internal information, or cause a denial-of-service condition. A patch is available, and the affected products are cloud services with vendor-managed remediation.
A denial of service vulnerability exists in FasterXML Jackson 1.x, specifically in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13. The vulnerability is triggered by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue. This can cause the application to become unresponsive or crash.