In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate rec->used in journal-replay file record check check_file_record() validates rec->total against the record size but never validates rec->used. The do_action() journal-replay handlers read rec->used from disk and use it to compute memmove lengths: DeleteAttribute: memmove(attr, ..., used - asize - roff) CreateAttribute: memmove(..., attr, used - roff) change_attr_size: memmove(..., used - PtrOffset(rec, next)) When rec->used is smaller than the offset of a validated attribute, or larger than the record size, these subtractions can underflow allowing us to copy huge amounts of memory in to a 4kb buffer, generally considered a bad idea overall. This requires a corrupted filesystem, which isn't a threat model the kernel really needs to worry about, but checking for such an obvious out-of-bounds value is good to keep things robust, especially on journal replay Fix this up by bounding rec->used correctly. This is much like commit b2bc7c44ed17 ("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot") which checked different values in this same switch statement.
A vulnerability in the Linux kernel ALSA ctxfi driver caused kernel crashes on certain hardware due to improper enumeration of the SPDIF1 type during DAIO initialization. The issue was introduced by a recent driver refactoring that looped over all DAIOTYP entries, including SPDIF1, which is only valid for specific hardware and undefined for others. The crash was fixed by skipping SPDIF1 in the parser loop.
A vulnerability in the Linux kernel's drm/i915/dsi driver involved incorrect horizontal timing adjustments for Display Stream Compression (DSC) in command mode. The issue caused improper timing calculations and could lead to a division-by-zero error on some machines, causing the kernel to crash when the driver loads. The flaw was fixed by stopping horizontal timing adjustments in command mode, aligning behavior with specifications and the Windows driver implementation.
CVE-2026-31699 is a high-severity vulnerability in the Linux kernel's crypto CCP driver. It occurs when the kernel attempts to copy a Certificate Signing Request (CSR) blob to userspace even if the firmware command to retrieve it failed. Specifically, if the failure is due to an invalid length (userspace buffer too small), copying the firmware-required bytes can overflow the kernel buffer and leak kernel memory to userspace. This flaw has been fixed in several Linux kernel commits.
CVE-2026-31698 is a high-severity vulnerability in the Linux kernel's crypto CCP driver. It occurs when the kernel attempts to copy a Platform Diffie-Hellman (PDH) certificate to userspace even if the underlying firmware command failed. Specifically, if the failure is due to an invalid length (userspace buffer too small), copying the firmware-required bytes can overflow the kernel buffer and leak kernel memory to userspace. This has been fixed in several Linux kernel commits.
CVE-2026-31697 is a high-severity vulnerability in the Linux kernel's crypto CCP driver. It occurs when the kernel attempts to copy a CPU ID blob to userspace after a firmware command failure, specifically if the failure is due to an invalid length. This can cause a kernel buffer overflow and leak kernel memory to userspace. The issue has been fixed in several Linux kernel commits.
Apache Neethi versions prior to 3.2.2 do not restrict URIs when manually fetching remote policy references via the PolicyReference API. This allows outbound requests to arbitrary protocols and internal IP addresses. Version 3.2.2 introduces restrictions allowing only http or https URIs and forbids link-local, multicast, and any-local addresses. Users should upgrade to 3.2.2 to address this issue.
Weblate versions prior to 5.17.1 do not revoke Django REST Framework API tokens when a user changes their password. While browser sessions are invalidated correctly, API tokens with the 'wlu_*' prefix remain valid, potentially allowing continued API access after a password change. This issue is fixed in version 5.17.1.
Red Hat OpenShift Data Foundation 4.19.15 security, enhancement & bug fix update
FIXED BUGS:
==========
DFBUGS-6345: RHODF 4.19.15
DFBUGS-5942: Backport to odf-4.19.z [External Mode]: noobaa-default-backing-store is in creating state due to "CheckExternalConnection Status=UNKNOWN_FAILURE Error=SELF_SIGNED_CERT_IN_CHAIN"
DFBUGS-5819: [Backport to odf-4.19.z] [IBM_Support][Fusion HCI]"storageclient-xxxxx-status-reporter job" doesn't inherits the tolerations defined in "ocs-client-operator-controller-manager" deployment
DFBUGS-5800: [Backport to odf-4.19.z] must-gather causes default RGW pools to be created and PGs to be stuck at 1
DFBUGS-4440: [4.19][ROSA HCP][UI]Bad gateway on Storage System creation wizard
CVEs:
==========
CVE-2026-34986
CVE-2025-61726
CVE-2026-33186
CVE-2025-61729
CVE-2026-4800
CVE-2025-58183
CVE-2026-33036
Phishing-to-RMM attacks exploit phishing techniques to gain unauthorized access to Remote Monitoring and Management (RMM) tools, creating a blind spot in business security. This threat highlights the risk of attackers leveraging phishing to compromise remote access systems, which are critical for IT management. The information is sourced from a Reddit Malware discussion with minimal technical details and no confirmed exploits in the wild. No specific affected software versions or patches are identified. The severity is assessed as medium based on the potential impact of unauthorized remote access.
** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.
This issue affects all versions of the Lua implementation of Pony Mail. There is a Python implementation under development under the name "Pony Mail Foal" that is not affected by this issue, but hasn't been released yet.
As the Lua implementation of this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Spring Boot's RabbitMQ auto-configuration in versions 3.5.0 through 3.5.13 and 4.0.0 through 4.0.5 does not perform hostname verification when using an SSL bundle to connect to the RabbitMQ broker. This vulnerability is fixed in versions 3.5.14 and 4.0.6.
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the component API Page Sort Endpoint. Executing a manipulation of the argument pages can lead to sql injection. The attack may be launched remotely. Upgrading to version 3.8.1 addresses this issue. It is suggested to upgrade the affected component. According to the researcher, "[t]he vendor explicitly stated they will not backport patches to the older affected versions."
In early April 2026, a large-scale device code phishing campaign targeted organizations across multiple sectors and regions, exploiting OAuth 2.0 Device Authorization Grant. Threat actors leveraged the Kali365 phishing-as-a-service platform, originating primarily from IP address 216.203.20[.]95. The campaign used high-fidelity lures directing victims to Microsoft's legitimate device login flow, where users unknowingly authorized threat actor-controlled sessions. Captured OAuth tokens enabled immediate mailbox access and post-compromise activities. In some cases, attackers established malicious inbox rules to suppress security notifications, extending dwell time. The Kali365 platform operates as a multi-tenant PhaaS ecosystem supporting both device code abuse and adversary-in-the-middle session capture, featuring rapid lure generation across multiple languages and file types, Cloudflare Worker-hosted pages, and token sharing capabilities between affiliates.
CVE-2026-31606 is a medium severity vulnerability in the Linux kernel's USB gadget HID function driver. It involves unsafe reinitialization of the character device (cdev) structure during unbind and bind operations when the device is still in use. This can lead to instability or denial of service due to improper handling of device references.
In the Linux kernel, the following vulnerability has been resolved: crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying When debug logging is enabled, read_key_from_user_keying() logs the first 8 bytes of the key payload and partially exposes the dm-crypt key. Stop logging any key bytes.
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial In rxrpc_post_response(), the code should be comparing the challenge serial number from the cached response before deciding to switch to a newer response, but looks at the newer packet private data instead, rendering the comparison always false. Fix this by switching to look at the older packet. Fix further[1] to substitute the new packet in place of the old one if newer and also to release whichever we don't use.