Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage CVE-2026-53002 kernel: netfilter: synproxy: refresh tcphdr after...

The vulnerability of the function batadv_bla_send_claim() in the net/batman-adv/bridge_loop_avoidance.c module, which is part of the network functions of the Linux operating system’s kernel, allows a hacker to trigger a service failure.

The vulnerability of the function batadvblasendclaim in the net/batman-adv/bridgeloopavoidance.c module, which is part of the network functions of the Linux operating system’s kernel, relates to the assignment of pointers. Exploiting this vulnerability could allow a malicious actor to cause servi...

CVE-2026-86083

n8n , an open-source workflow automation platform, is affected by a sandbox escape in its legacy expression engine. The root cause is that the engine called the mutable global JSON.stringify while generating source text for synthetic string literals and timezone interpolation. A crafted expressio...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-86711

electerm versions before 5.3.15 are affected by an arbitrary command execution vulnerability in the runGlobalAsync Electron IPC handler (src/app/lib/ipc.js). The handler exposes over 40 main-process functions without a function-name allowlist or sender validation, allowing renderer-side script ex...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

EUVD-2026-72957

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

PT-2026-87176

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

EulerOS 2.0 SP12 : lxc (EulerOS-SA-2026-3282)

According to the versions of the lxc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the findline function that allows an...

CVE-2026-78997

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) is vulnerable to a Universal Cross-Site Scripting (UXSS) flaw. The root cause lies in the privileged ucapi JavaScript bridge; specifically, the account.openLoginWindow API stores attacker-controlled JavaScript strings as call...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053414)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053414 advisory. In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an uninit...

EUVD-2026-71994

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

CVE-2026-86185

Bilibili Desktop through 1.18.0 contains two compounding weaknesses: TLS certificate verification is disabled process-wide, and unsigned remote JavaScript configuration is executed without integrity checks. An on-path attacker can intercept configuration fetches, inject arbitrary JavaScript that ...

CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

SUSE CVE-2026-80842

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

PT-2026-86410

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...