Common Vulnerabilities and Exposures (CVE)

CVE-2026-49428

Aug 19, 2026 05:57:04 UTC

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An un...

CVE-2026-49427

Aug 19, 2026 05:56:53 UTC

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referr...

CVE-2026-49422

Aug 19, 2026 05:28:32 UTC

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to...

CVE-2026-49421

Aug 19, 2026 05:25:43 UTC

The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restrict...

CVE-2026-49420

Aug 19, 2026 05:20:00 UTC

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffi...

CVE-2026-49431

Aug 19, 2026 05:15:37 UTC

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream. Any l...

CVE-2026-49430

Aug 19, 2026 05:15:29 UTC

The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" ...

CVE-2026-49429

Aug 19, 2026 05:15:21 UTC

The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with ...

CVE-2026-55654

Aug 19, 2026 05:06:55 UTC

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-...

CVE-2026-59849

Aug 19, 2026 04:57:42 UTC

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial o...

CVE-2026-59846

Aug 19, 2026 04:57:37 UTC

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

CVE-2026-59842

Aug 19, 2026 04:57:33 UTC

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow...

CVE-2026-70408

Aug 19, 2026 04:54:02 UTC

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.

CVE-2026-66358

Aug 19, 2026 04:53:33 UTC

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

CVE-2026-71573

Aug 19, 2026 04:50:02 UTC

Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.