Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

Bindings Component DoS

The vulnerability of the Bindings component in Google Chrome and Microsoft Edge is related to type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Linux kernel IIO Light BH1780 DoS

The vulnerability in the bh1780readraw function within the drivers/iio/light/bh1780.c file of the Linux kernel phot sensor driver is related to errors occurring during link counter updates. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Linux USB Device Driver Heap Buffer Overflow DoS

The vulnerability of the wdmincallback function in the drivers/usb/class/cdc-wdm.c file of the Linux operating system’s USB device driver framework is related to security configuration errors. Exploiting this vulnerability could allow an attacker to cause service failures...

Google Chrome XML Component Confidential Data Access

The vulnerability of XML components in Google Chrome and Microsoft Edge browsers is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created XML file...

Skia Graphic Library Confidential Data Access

The vulnerability of the Skia graphic library in Google Chrome and Microsoft Edge is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

Intel Data Accelerator DMA Driver DoS

The vulnerability in the idxdconfdevicerelease function within drivers/dma/idxd/sysfs.c of the Intel Data Accelerator DMA driver for Linux kernel is related to an unvalidated error condition. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

CVE-2026-78693

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

EUVD-2026-68288

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

EEF-CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and...

CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-78693

ash_graphql (ash-project, Elixir/Erlang) is vulnerable to incomplete error-message redaction . In AshGraphql.Errors, the configured error_handler output is merged with the pre-handler path via Map.put_new(handled, :path, path), which re-injects the original path even when a sanitizing handler rem...

EEF-CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-81322

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

EUVD-2026-68282

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

OESA-2026-3549 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...

PT-2026-83545

Uncontrolled Recursion vulnerability in ash-project ash oban allows a user who can drive a trigger's on error action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handle error/4 runs the trigger's on error action on a job's final...