2026

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix error path at svm_migrate_copy_to_r

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqd_mgr dereference in pqm

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at s

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: ofdrm: Fix integer overflow in fb_size c

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Fix folio allocation fallback and use-

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: unsubscribe the channel-kill event bef

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OP_MA

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on fail

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwindi

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_get_stackid The get

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notifica

In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500_fg: fix use-after-free on rem

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamond_merge_regions

In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound re

The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments betwee

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions with

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit

In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char devi

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connectio

The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions p

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience c

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an

Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a cra

When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields int

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation

The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authent

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confiden

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Air

Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Gr

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain

A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentia

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafte

An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary c

On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remo

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 p

On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafte

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, z

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can dis

On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interfa

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a respon

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config