THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,767 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-98454 — In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2…
High · CVSS 3.1 8.1 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState a…
CVE-2026-98454Read original ↗ (opens in a new tab) - NVD
CVE-2026-98453 — In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing f…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2_open() accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2_parse_contexts() rejects malformed context data, SMB2_open() returns without closing the handle, leaving the server-side handle open and num_remote_opens elevated. Close the handle after a post-CREATE context parsing failure so the error path releases the remote resource and b…
CVE-2026-98453Read original ↗ (opens in a new tab) - NVD
CVE-2026-98452 — In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open_cached_dir() sends CREATE and QUERY_INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2_close(). It also must not treat a response error as a valid CREATE. Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from late…
CVE-2026-98452Read original ↗ (opens in a new tab) - NVD
CVE-2026-98451 — In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes…
High · CVSS 3.1 8.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular…
CVE-2026-98451Read original ↗ (opens in a new tab) - NVD
CVE-2026-98450 — In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait er…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compound_send_recv() waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already have opened a remote handle. The earlier mid is then released without invoking handle_cancelled_mid(), leaving the remote handle open because no FID was copied to the caller. Mark completed earlier mids as cancelled when…
CVE-2026-98450Read original ↗ (opens in a new tab) - NVD
CVE-2026-98449 — In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smb_send_rqst() kicks off a reconnect. compound_send_recv() still has those mids on pending_mid_q, but it unlocks the server without removing them first. During reconnect, cifs_abort_connection() walks pending_mid_q and runs each mid callback. With no response yet, those callbacks return credits and drop in_flight. Then compound_send_recv()'s sen…
CVE-2026-98449Read original ↗ (opens in a new tab) - NVD
CVE-2026-98448 — In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM po…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that.
CVE-2026-98448Read original ↗ (opens in a new tab) - NVD
CVE-2026-98447 — In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtref…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory corruption of whatever's beyond the buffers.
CVE-2026-98447Read original ↗ (opens in a new tab) - NVD
CVE-2026-98446 — In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden_space go negative in xfs_metafile_resv_init LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hidden_space subtraction can underflow, causing xfs_dec_fdblocks to subtract a huge amount of space. We never want the target to be less than the used sapce, so fix the logic that adjusts dblocks_avail downwards. Also fix an error in…
CVE-2026-98446Read original ↗ (opens in a new tab) - NVD
CVE-2026-98445 — In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repa…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrep_newbt_add_blocks results in online repair leaking blocks that were previously allocated to write a new btree, but the problem is worse than that -- a limitation of the codebase is that the callers cannot undo the transaction /and/ return the error -- either you undo all changes and commit the transaction, or you error out and the fi…
CVE-2026-98445Read original ↗ (opens in a new tab) - NVD
CVE-2026-98444 — In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer t…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is going to drop the dqflock, so we need to do it ourselves.
CVE-2026-98444Read original ↗ (opens in a new tab) - NVD
CVE-2026-98443 — In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iun…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlog_recover_iunlink_bucket: 1. We don't null out prev_ip after releasing it, which can lead to UAF problems if the inodegc flush call in the loop fails. at which point I noticed even more bugs: 2. If the inodegc flush inside the loop fails, we also leak @ip. 3. We set prev_agino to agino having already advanced agino, which results in inodes with i_pre…
CVE-2026-98443Read original ↗ (opens in a new tab) - NVD
CVE-2026-98442 — In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions real…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension sp…
CVE-2026-98442Read original ↗ (opens in a new tab) - NVD
CVE-2026-98441 — In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: avoid modifying shared unconfirmed ct…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The first clone wants to commit and runs the helpers wiring up the extension pointer into the expectation list. 2. Then it looses the confirmation keeping the entry unconfirmed. 3. Second clone now wants to commit labels or ru…
CVE-2026-98441Read original ↗ (opens in a new tab) - NVD
CVE-2026-98440 — In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures un…
High · CVSS 3.1 7.0 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvm_arch_flush_shadow_all(), which is a Bad Idea(tm). Freeing the page tables is fair game (this is what this callback is for), but freeing the container that could still be referenced by another part of the system is not great. Instead, grow separate destructors that gets called when we tear the VM down for good. From there, we can nuk…
CVE-2026-98440Read original ↗ (opens in a new tab) - NVD
CVE-2026-98439 — In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connectio…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finish.
CVE-2026-98439Read original ↗ (opens in a new tab) - NVD
CVE-2026-98438 — In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcp_write_data_fin…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcp_write_data_fin When sending a DATA_FIN without data, and because the DATA_FIN occupies 1 octet of the connection-level sequence space [1], it is then required to add a DSS mapping with specific values. If the checksum has been negotiated, it also needs to be computed, and included in the outgoing packet, and thus the initial csum data needs to be reset to 0 as well. This is no longer the case since commit…
CVE-2026-98438Read original ↗ (opens in a new tab) - NVD
CVE-2026-98437 — In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pm_runtime_resume_and_get() in iris_enable_power_domains() to avoid leaking a runtime PM usage count on failure. Also ensure pm_runtime_put_sync() is always called in iris_disable_power_domains(), even when iris_opp_set_rate() fails, so runtime PM references remain balanced.
CVE-2026-98437Read original ↗ (opens in a new tab) - NVD
CVE-2026-98436 — In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device bu…
High · CVSS 3.1 7.8 · Assessor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly.
CVE-2026-98436Read original ↗ (opens in a new tab) - NVD
CVE-2026-98435 — In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altr_portb_…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altr_portb_setup() Anchor the devres group and the devm-managed IRQ requests in altr_portb_setup() to the actual parent device (device->edac->dev) instead of the embedded struct device inside the copied per-port altr_edac_device_dev. This keeps devres_open_group(), devm_request_irq(), devres_remove_group() and devres_release_group() all referring to the same long-lived device so the group and the resour…
CVE-2026-98435Read original ↗ (opens in a new tab) - NVD
CVE-2026-98434 — In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in proc_dointvec_ms_jiffies_minmax A…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in proc_dointvec_ms_jiffies_minmax Add the range check to do_proc_int_conv_ms_jiffies_minmax that commit d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions") incorrectly removed.
CVE-2026-98434Read original ↗ (opens in a new tab) - NVD
CVE-2026-98433 — In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uv_p…
CVSS unscored / not supplied
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap, allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets refcount=1 and locks the page. The subsequent goto out_fina…
CVE-2026-98433Read original ↗ (opens in a new tab) - NVD
CVE-2026-111991 — A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBack…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-111991Read original ↗ (opens in a new tab) - NVD
CVE-2026-111990 — A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This…
Medium · CVSS 4.0 5.5 · Assessor: [email protected]
A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded…
CVE-2026-111990Read original ↗ (opens in a new tab) - NVD
CVE-2026-111988 — A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of th…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.
CVE-2026-111988Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.