CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

chromium-browser: libyuv: chromium-browser: Heap buffer overflow in libyuv

A heap buffer overflow flaw was found in the libyuv component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514748734...

EUVD-2026-45970

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

UBUNTU-CVE-2026-64621

FreeRDP before 3.28.0 affected 3.x through 3.27.1 contains a double-free vulnerability in freerdpclientrdpfileapplytosettings client/common/file.c when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning...

EUVD-2026-45917

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause...

RHSA-2026:41892 Red Hat Security Advisory: libtiff security, bug fix, and enhancement update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7343: RHODF 4.18.25 release DFBUGS-7010: GSS kube-rbac-proxy in OCS metrics exporter logging full bearer...

PT-2026-61732

Name of the Vulnerable Software and Affected Versions ClearanceKit versions prior to 5.0.10 Description ClearanceKit enforces per-process access policies by intercepting file-system access events on macOS. The software uses an ECDSA private key stored in the macOS System Keychain to sign the...

Linux Distros Unpatched Vulnerability : CVE-2026-64072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if...

Linux Distros Unpatched Vulnerability : CVE-2026-64065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfs: fix VMBUGONFOLIO issue in netfswritebegin call The multiple runs of generic/013...

Linux Distros Unpatched Vulnerability : CVE-2026-63812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: fix incorrect FINOEXTENT handling in destroyextentnode When destroyextentnode sets the inode flag FINOEXTENT, it does not reset the length of the largest...

ALSA-2026:41895 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18...

Linux Distros Unpatched Vulnerability : CVE-2026-64028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns everywhere...

Linux Distros Unpatched Vulnerability : CVE-2026-64055

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ethernet: cortina: Carry over frag counter The gmacrx NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely...

Linux Distros Unpatched Vulnerability : CVE-2026-64075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fprobe: Fix unregisterfprobe to wait for RCU grace period Commit 4346ba1604093 fprobe: Rewri...

Linux Distros Unpatched Vulnerability : CVE-2026-63893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-63905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The...

Linux Distros Unpatched Vulnerability : CVE-2026-63837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output enaphcgettimex64 is setting...

Linux Distros Unpatched Vulnerability : CVE-2026-64121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ifb: report ethtool stats over numtxqueues ifbdevinit allocates dp-txprivate to dev-numtxqueues entries via kzallocobjstxp, dev-numtxqueues. Both IFB...

Linux Distros Unpatched Vulnerability : CVE-2026-64162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is...