CVE-2026-98366 is a vulnerability in the Linux kernel's RDMA rxe driver where access flags are not validated before swapping the memory region's protection domain (PD). This improper ordering can lead to use-after-free conditions when the PD reference counts are mishandled, potentially causing memory corruption. The issue is fixed by validating access flags before mutating any state to ensure atomicity of changes.
CVE-2026-98365 is a critical vulnerability in the Linux kernel's RDMA rxe driver where an integer overflow in the mr_check_range() function allows an out-of-bounds (OOB) read/write. This occurs because the original range check uses wraparound-prone arithmetic, enabling a remote unauthenticated peer to craft RDMA requests that bypass validation and cause kernel memory corruption and a kernel oops. The vulnerability is fixed by rewriting the range check to be overflow-safe, preventing the OOB access and causing the responder to report an error instead.
CVE-2026-98361 is a vulnerability in the Linux kernel's RDMA rxe driver where a missing write permission check in on-demand paging (ODP) write paths allows unprivileged users to overwrite read-only page cache memory. This flaw enables modification of files such as /etc/passwd or setuid binaries by registering an ODP memory region over a read-only mapping, similar in nature to Dirty COW. The issue was introduced by a commit that removed the HMM_PFN_WRITE check, causing endless pagefault loops and improper write access. The vulnerability is fixed by restoring the HMM_PFN_WRITE check in the rxe driver, preventing unauthorized writes to non-writable memory regions.
CVE-2026-98360 is a high-severity vulnerability in the Linux kernel's RDMA/rxe subsystem. It involves improper handling of multicast group insertion into the mcg_tree before the backing Ethernet multicast address is programmed. This can lead to use-after-free errors when a multicast group is freed without being removed from the tree after a failure in rxe_mcast_add(). The issue has been fixed by ensuring the multicast group is only published after successful programming of the multicast address.
An off-by-one bounds check vulnerability in the Linux kernel Bluetooth driver btintel_pcie was fixed. The function btintel_pcie_submit_rx() incorrectly allowed an index equal to the array count, leading to an out-of-bounds access. The check was corrected to reject all out-of-range indices.
A vulnerability in the Linux kernel's Cortina Ethernet driver related to incorrect acknowledgment of RX overrun interrupts has been resolved. The issue involved the gmac_irq() function acknowledging the RX overrun interrupt using an incorrect status register bit, causing improper handling of the interrupt. The fix ensures that the per-port RX overrun bit that was detected is correctly acknowledged.
CVE-2026-98239 is a use-after-free vulnerability in the lan743x network driver of the Linux kernel. The flaw occurs when processing receive buffers for packets spanning multiple buffers, leading to a write to freed memory. This issue has been fixed in patched Linux kernel versions. The vulnerability has a high severity score of 8.1 CVSS v3.1 and impacts Linux kernel version 6.1.
A vulnerability in the Linux kernel's net/packet subsystem caused the RX owner bit to remain set on a VNET header error, leading to packet ring slots being incorrectly claimed and unavailable. This could cause packet drops in certain configurations, such as with a one-frame TPACKET_V2 ring handling unsupported UDP GSO packets. The issue has been fixed by clearing the ownership bit on the error path.
A vulnerability in the Linux kernel's wilc1000 WiFi driver allows an out-of-bounds write to the RX buffer due to improper size validation of device-reported RX transfer sizes. This can lead to memory corruption when a malicious SDIO device sends an oversized transfer. The issue is fixed by dropping transfers that exceed the RX buffer size, preventing overflow and maintaining driver stability.
Social engineering remains a highly effective attack vector despite widespread security awareness training, which shows little evidence of effectively preventing such attacks. Recent high-profile incidents, including breaches at Las Vegas casinos and Brinks Home, demonstrate attackers using voice phishing and help desk manipulation to bypass security controls like MFA. Human detection of social engineering is unreliable, especially with increasingly sophisticated AI deepfake techniques. Technology solutions, such as Netarx's AI-driven detection system, are emerging to identify social engineering attempts in real time by analyzing multiple digital and metadata signals during live communications. These systems provide users with real-time risk indicators rather than autonomously blocking interactions, aiming to empower human decision-making. Social engineering continues to pose a serious threat to enterprise security, bypassing traditional technical defenses when successful.
A vulnerability in ModSecurity related to PCRE2 error handling can cause match-limit fail-open behavior and crashes due to invalid patterns. This affects multiple specific versions of ModSecurity. The severity is assessed as medium. No CVSS score or known exploits in the wild are reported.
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
LaraDashboard versions from 1.4.0 up to but not including 1.4.8 have a race condition vulnerability in the RegisterController::register function. This flaw allows unauthenticated attackers to bypass the per-IP daily registration limit by sending many concurrent registration requests, enabling bulk account creation and defeating anti-automation controls. The vulnerability has a CVSS score of 3.7, indicating medium severity.
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found and stored accepted positions at a secret index. Both run on secret inputs during encapsulation and decapsulation, and the sampler re-expands the secret key from its seed on every decapsulation, so an attacker able to observe cache behaviour or decapsulation timing can recover information about the HQC private key. The field arithmetic is now table-free and the sampler branch-free within a batch of candidates, with output and randomness consumption unchanged.
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires no authentication, no nonce, and no capability — the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the forged X-Real-IP header from any unauthenticated HTTP request and stores the entity-encoded payload verbatim in the database.