Security update for openexr

This update for openexr fixes the following issue: CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file containing an unknown-type attribute with dataSize set to zero is processed bsc1282700. Patch Instructions: To install this SUSE update u...

SUSE-SU-2026:4532-1 Security update for openexr

This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a specially crafted EXR file containing an unknown-type attribute with dataSize set to zero is processed bsc1282700...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

CVE-2019-11043

CVE-2019-11043 تنفيذ كود عن بُعد في PHP-FPM Screencast: https://youtu.be/d6benC5FVZM نظرة عامة اكتُشف هذا الاستغلال من نوع zero-day في إعدادات PHP-FPM الشائعة خلال مسابقة Realworld CTF في عام 2019. يُستخدم تعبير منتظم لتحليل URI المطلوب، لكن أحرف السطر الجديد %0a لا تُطابَق. يؤدي ذلك إلى إثارة خل...

CLEANSTART-2026-OS01121 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...

Security vulnerability affects the rundeck package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector...

PT-2026-106507

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpu amdkfd clear kfd mapping assumes that a non-NULL kfd dev has a fully populated node array. This is not true when KFD device initialization fails after probe. For...

PT-2026-106643

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-private data before registering the PCM timer snd pcm timer init calls snd device register to link the new struct snd timer into the global timer list while it still carries hw.c resolution = snd pcm timer...

CVE-2026-98346: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

CVE-2026-98335: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...

PT-2026-106614

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in vlan del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL...

PT-2026-106687

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser reg mem fastreg takes the DMA key path and leaves rdma regISER DIR OUT.desc ...

CVE-2026-98270: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check ras and obj before dereference nbiov79handlerascontrollerintrnobifring dereferences ras and obj without checking either for NULL. Both amdgpurasgetcontext and amdgpurasfindobj can return NULL, e.g. during the...

PT-2026-106599

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check ras and obj before dereference nbio v7 9 handle ras controller intr no bifring dereferences ras and obj without checking either for NULL. Both amdgpu ras get context and amdgpu ras find obj can return NULL, e.g...

PT-2026-106664

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211 stop mesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably...

PT-2026-106675

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211 calculate bi data calls rdev get radio mask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

PT-2026-106597

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in is include guest event A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmu detach event pmu...

Linux Distros Unpatched Vulnerability : CVE-2026-98270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: check ras and obj before dereference nbiov79handlerascontrollerintrnobifring dereferences ras and obj without checking either for NULL. Both...

PT-2026-106637

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98220: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scxbpfselectcpuand and scxbpfdsqinsertvtime refuse the call and report to @p's scheduler:...

CVE-2026-98182: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...