CVE-2026-68117

The CVE-2026-68117 issue affects the Linux kernel’s Transparent Inter-Process Communication (TIPC) socket path. When tipc_sk_create() fails to insert a new socket during accept(), sock->sk can point to a freed object, enabling a use-after-free write in lock_sock_nested and potentially crashing...

CVE-2026-68117 tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock-sk on the failed-insert path in tipcskcreate When tipcskcreate fails to insert the new socket tipcskinsert returns non-zero, its error path frees the sk with skfree but leaves sock-sk pointing at the freed object...

CVE-2026-68116

CVE-2026-68116 affects the Linux kernel VXLAN MDB replacement path. When replacing the source list of an MDB remote entry, the old sources are marked for deletion and the new list is added; if vxlan_mdb_remote_srcs_add() fails partway, the original rollback could delete pre-existing sources along...

CVE-2026-68116 vxlan: mdb: Fix source list corruption on a failed replace

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a failed replace When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlanmdbremotesrcsadd is then called to add the new source...

Linux Distros Unpatched Vulnerability : CVE-2026-54338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators c...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

DEBIAN-CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338

JupyterHub prior to 5.5.0 is affected by a vulnerability in its form-based login authenticators where invalid input can place an attacker-controlled username into failed-login logs. This can allow an unauthenticated attacker to exhaust logging and storage resources, effectively a denial of servic...

CVE-2026-54338 JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

OSV-2026-1110 Check failed in CheckUnwind

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541969271 Crash type: Check failed Crash state: CheckUnwind mrbbasicallocfunc pmnodehashinsert...

PT-2026-89553

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=541969271 Crash type: Check failed Crash state: CheckUnwind mrb basic alloc func pm node hash insert...

Important: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: httplib2: httplib2: Denial of Service via unbounded decompression of HT...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk15 is a package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Affected versions of this package are vulnerable to Improper Validation of Integrity...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

SUSE CVE-2026-33758

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...