Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001445)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001445 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2filereaditer Syzbot has reported the following KMSAN splat...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001425)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001425 advisory. In the Linux kernel, the following vulnerability has been resolved: ppp: fix pppasyncencode illegal access syzbot reported an issue in pppasyncencode 1 In this case,...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-002515)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002515 advisory. In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: make sure to pull inner header in iptunnelrcv Apply the same fix than ones found i...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001507)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001507 advisory. In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtpdevxmit syzbot/KMSAN reported use of uninit-value in getdevxmit 1...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001397)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001397 advisory. In the Linux kernel, the following vulnerability has been resolved: slip: make slhcremember more robust against malicious packets syzbot found that slhcremember was...

Malicious code in data-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL...

MAL-2026-15533 Malicious code in data-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL...

Improper Neutralization of Special Elements

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in its syslog key-value message parser, which handles the key-value format emitted by Fortigate devices. An attacker can overwrite...

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices. The vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will...

CVE-2026-55841 Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and...

CVE-2026-55841

Graylog (a free and open log management platform) is affected by a parsing flaw in its FortiGate key-value syslog parser (GLFortiGateSyslogEvent.java and SyslogCodec.java). The root cause is that KV_PATTERN and QUOTED_KV_PATTERN mishandle field-like text inside quoted values: crafted values conta...

CVE-2026-55891 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

SUSE CVE-2026-80656

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

SUSE CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

WordPress Library Management System plugin < 3.6.7 - Subscriber+ SQL Injection via Filter Value vulnerability

Subscriber+ SQL Injection via Filter Value vulnerability discovered by João Ramos Maciel in WordPress Plugin Library Management System versions 3.6.7...

CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

CVE-2026-80711

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...

CVE-2026-80656

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

CVE-2026-80656

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

CVE-2026-80711

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...