GHSA-XQP3-JQ6G-X3QM vulnerabilities

Vulnerabilities for packages: filebrowser...

CVE-2026-64490

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. That metadata is then used directly to index gv2atypemap in...

CVE-2026-64475

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

CVE-2026-64458

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

CVE-2026-64427

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

CVE-2026-64408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64305

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with servicelock The servicetable list is protected by servicelock when entries are added or removed in adfserviceadd and adfserviceremove, but several functions iterate over the lis...

CVE-2026-64257

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

GHSA-4QHR-G3C6-FCFX vulnerabilities

Vulnerabilities for packages: celeborn, tez, management-api-for-apache-cassandra-5.0, thingsboard...

CVE-2026-56817 vulnerabilities

Vulnerabilities for packages: tez, pinot-fips, seata, tinkerpop, thingsboard, hadoop-fips, celeborn, apache-hop-fips, pinot, management-api-for-apache-cassandra-5.0, apache-hop...

GHSA-4VJ7-5MJ6-JM8M vulnerabilities

Vulnerabilities for packages: tileserver-gl...

GHSA-48RX-C7PG-Q66R vulnerabilities

Vulnerabilities for packages: kube-logging-operator, cinc-auditor...

GHSA-Q6CQ-MHR2-JMR5 vulnerabilities

Vulnerabilities for packages: keycloak-fips, hono, apache-hop, apache-pulsar-fips, zipkin, request-9047-keycloak-fips, apache-pulsar, apache-activemq-artemis, seata, apicurio-registry-fips, tinkerpop, apicurio-registry, thingsboard, keycloak, celeborn, neo4j, tez, pinot-fips, floci-az,...

GHSA-P9J2-GV94-2WF4 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu...

GHSA-WH89-7897-X99H vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, apicurio-registry, keycloak, celeborn, neo4j, tez, zipkin, apache-activemq-artemis, apache-pulsar, thingsboard...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

GHSA-G7HG-VRCF-MVMR vulnerabilities

Vulnerabilities for packages: tez, pinot-fips, pinot, seata, tinkerpop, cassandra, thingsboard, hadoop-fips, apache-hop-fips, cassandra-fips, management-api-for-apache-cassandra-5.0, apache-hop...

GHSA-272M-GCWP-MPWG vulnerabilities

Vulnerabilities for packages: tez, pinot-fips, pinot, seata, tinkerpop, cassandra, thingsboard, hadoop-fips, apache-hop-fips, cassandra-fips, management-api-for-apache-cassandra-5.0, apache-hop...