CVE-2026-98996 is a Linux kernel vulnerability where the system may silently unmount busy mounts during propagation, causing mounts still in use to be detached. This occurs due to propagate_mount_busy() not properly checking references on certain mount copies, allowing synchronous unmounts to succeed incorrectly. The issue affects multiple Linux kernel versions from 4.1.43 up to and including 4.13. The vulnerability has been fixed in Linux kernel versions 4.2, 4.5, 4.10, 4.12, and 4.13.
A concurrency issue in the Linux kernel's cxgb4/ch_ktls component was fixed by disabling softirqs around tid_list erases. The flaw involved improper locking when erasing entries from a shared XArray, which could lead to deadlocks due to softirq interruptions during cleanup. The issue affects specific Linux kernel versions prior to 5.11, between 5.12.9 and 5.13, and version 5.13 itself.
CVE-2026-98964 is a high-severity vulnerability in the Linux kernel's nvmet subsystem. It involves improper handling of the local peer-to-peer (P2P) device pointer during metadata allocation failure, which can lead to incorrect cleanup operations. This flaw was fixed in Linux kernel version 5.13 and other specified commits.
A memory management issue in the Linux kernel's btrfs subsystem was fixed where the function btrfs_uring_read_extent() failed to free allocated iov memory on error paths except for a specific deferred case. This could lead to a memory leak. The issue affects Linux kernel version 6.13 and has been corrected in subsequent commits.
CVE-2026-98959 is a critical vulnerability in the Linux kernel's Btrfs filesystem related to extended attribute (xattr) handling. When multiple xattrs are packed in the same btrfs_dir_item and one xattr is replaced with a value of a different size, the kernel fails to fully initialize the new btrfs_dir_item. This causes filesystem corruption detected during extent buffer writeback, leading to transaction aborts and potential data loss. The issue occurs because the deletion and insertion of xattr items shift data in the leaf, leaving parts uninitialized. The vulnerability affects multiple Linux kernel versions prior to 3.11, 3.13, 3.15, and 3.19, with fixes applied in those versions. The CVSS 3.1 score is 9.8, indicating critical severity.
CVE-2026-107858 is a high-severity vulnerability in Google Agent Development Kit (ADK) for Java versions before 1.13.0. It involves missing origin validation in WebSockets and permissive cross-domain policies, allowing remote attackers to control a locally running agent via malicious web pages. The vulnerability affects the /run_live WebSocket endpoint and REST API, which accept connections and requests from any origin by default. This enables cross-origin attacks that can trigger tools, stream responses, and manipulate sessions and artifacts. The issue is fixed in version 1.13.0 by enforcing same-origin policies and rejecting DNS-rebinding requests over loopback.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. An unauthenticated attacker who submits a forgot-password request for a known account while sending a spoofed Host header causes Part-DB to email that account a reset link whose hostname is attacker-controlled, while still embedding the genuine reset token. When the victim opens the link (or an automated inbound mail-security scanner dereferences it), the valid token is disclosed to the attacker, who replays it against the real instance to set a new password and take over the account. Because the seeded admin account can be targeted, this yields full pre-authentication administrative account takeover. This issue has been patched in version 2.13.3.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
Part-DB-server versions prior to 2.13.2 contain a vulnerability where authenticated API users can bypass the configured maximum attachment file size by uploading base64-encoded files through the API. This bypass allows uploading files larger than the intended limit, potentially exhausting disk space and causing a denial of service. The issue has been fixed in version 2.13.2.
Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the configured MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum attachment size, potentially exhausting disk space and causing a denial of service. This issue has been patched in version 2.13.2.
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.
PyJWT versions up to 2.13.0 and the current master branch contain a vulnerability where the HMACAlgorithm.from_jwk method accepts an empty HMAC key from a symmetric oct JWK without raising an error. This allows an attacker to forge tokens by exploiting the verification process that uses this empty key, bypassing signature verification when the key is sourced from a JWK with an empty 'k' value. The issue affects verification paths using PyJWK, PyJWKSet, or PyJWKClient. The vulnerability requires no authentication but depends on the verifier trusting a JWKS containing an empty key entry, which can happen due to misconfiguration or unset environment variables. A fix is available.
Next.js versions from 13.0.0 up to but excluding 15.5.28, and from 16.0.0 up to but excluding 16.4.1, contain a vulnerability where crafted requests targeting App Router applications with Server Actions can cause excessive CPU usage and block further request processing in the same process. Applications using the Pages Router or App Router without Server Actions are not affected. This issue is fixed in versions 15.5.28 and 16.4.1.
A vulnerability in libyang versions through 6.4.13 allows remote NETCONF peers to cause a server crash or heap corruption by sending a crafted NETCONF rpc action envelope. The flaw is due to an uninitialized pointer free in the lydxml_env_netconf_rpc() function when parsing such envelopes.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).