Vulnerability Intelligence

CVE-2026-98684: In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents

CVE-2026-98683: In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3_zero_range() emulates FALLOC_FL_ZERO_RANGE by invalidating the page cache over the target range with truncate_pagecache_range() and then issuing FSCTL_SET_ZERO_DATA to the server

CVE-2026-98682: In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifs_file_copychunk_range() and the clone (FICLONE) path of cifs_remap_file_range() do not serialise the destination page cache against the server-side copy the way the other server-side range operations (smb3_zero_range(), smb3_punch_hole(), smb3_collapse_range() and smb3_insert_range()) do

CVE-2026-98613: In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs

CVE-2026-98566: In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array

CWE-22 • CVE-2026-112051: Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name

CWE-89 • CVE-2026-112017: JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments

CWE-863 • CVE-2026-112001: ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}

CWE-287 • CVE-2026-111898: phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email

CWE-287 • CVE-2026-111895: phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account

CWE-287 • CVE-2026-111882: phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks

CWE-390 • CVE-2026-111823: Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

CWE-367 • util-linux mount hook_owner TOCTOU allows local privilege escalation

CWE-367 • util-linux mount target TOCTOU allows local privilege escalation

CWE-444 • Squid Request Smuggling in HTTP Transfer-Encoding

RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers

qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string

CWE-122 • NGINX Map directive and Regex matching vulnerability

CWE-908 • NGINX ngx_http_ssl_module vulnerability

NGINX ngx_http_js_module vulnerability

CWE-436 • NGINX ngx_http_js_module vulnerability

NGINX ngx_http_v3_module vulnerability

CWE-122 • NGINX ngx_http_core_module vulnerability

CWE-416 • NGINX ngx_http_core_module vulnerability

Openssh: openssh: sftp can write outside the destination directory from a server-supplied path