Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098787)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098787 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104606)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104606 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd ipvs: avoid kmemcachezalloc i...

CVE-2025-61480

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098737)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098737 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: add seqadj extension for natted connections Sequence adjustment may be required...

NPM: pickem vulnerable to terminal escape-sequence injection via unsanitized item text

NPM: pickem vulnerable to terminal escape-sequence injection via unsanitized item text vulnerability discovered by ? in WordPress Npm pickem versions 1.0.7...

GHSA-8QX3-8GM5-9CJ2 pickem vulnerable to terminal escape-sequence injection via unsanitized item text

Impact pickem rendered item text label, description, group, meta, name to the terminal with no control-character sanitization. chrome.row only stripped ANSI from the active row; inactive rows, the public createFormatter, and selection-summary lines printed labels raw, and the ANSI strip missed ba...

CVE-2026-16599 Denial of Service in GNU wget

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...

CVE-2026-16599: Unchecked Input for Loop Condition

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network...

PT-2026-81317

Name of the Vulnerable Software and Affected Versions GNU wget versions prior to 1.25.0 Description GNU wget is susceptible to a denial of service in its FTP OPIE/S-KEY authentication functionality. The issue occurs because the software uses a server-supplied sequence number from the FTP challeng...

CVE-2026-62377

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker could provide a specially crafted HEIF sequence. Processing this malicious file could lead to a reachable assertion or dereference an empty map, resulting in a crash of the application. This...

CVE-2026-50142

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker can provide a specially crafted HEIF sequence that triggers an unbounded heap allocation. This occurs because the HEIF sequence parser's fixed-size mode is missing a bound check, and an integer...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: dlm: fixed the addition of a message handling mechanism in sendqueue. In a benchmark scenario where many requests are triggered, which results in a large number of DLM messages being sent across the network, it is possible that...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fixed a race condition in sndseqtimeropen. The timer instance per queue is exclusive, and sndseqtimeropen should handle concurrent accesses properly. It seems that the function checks for an already existing timer...

SUSE CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

SUSE CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

Linux Distros Unpatched Vulnerability : CVE-2026-72847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call...

GHSA-X3G7-QRWC-F6C5 Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

Summary Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences CWE-150. Those log fields are populated from arbitrary, unauthenticated...

CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

DEBIAN-CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

EUVD-2026-63488

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...