CVE-2026-10090: Privilege Defined With Unsafe Actions

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

PT-2026-68085

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes ACM affected versions not specified Description A flaw in the Application Subscription controller multicluster-operators-subscription allows a user with namespace-scoped edit privileges in an...

CVE-2026-50351: Improper Access Control

Improper access control in Windows Audio Compression Manager ACM allows an authorized attacker to elevate privileges locally...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: kyverno-fips, restic-fips, trivy, gitlab-cng, terraform-provider-azurerm-fips, crossplane-provider-aws-vpc-fips, kube-state-metrics, k9s-fips, crossplane-provider-aws-guardduty-fips, crossplane-provider-aws-elasticache-fips, crossplane-provider-aws-rds,...

CVE-2026-10101: Insertion of Sensitive Information Into Sent Data

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions.message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's...

PT-2026-36097

Name of the Vulnerable Software and Affected Versions Multicluster Engine affected versions not specified Red Hat Advanced Cluster Management affected versions not specified Description A flaw in the assisted-service REST API, an optional Assisted Installer component in the Multicluster Engine,...

LSN-0119-1 Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfsreftreemod after we successfully inserted the new ref entry local variable 'ref' into the respective block entry's rbtree local variable 'be', if we find an...

The vulnerability of the acm_bind() function in the drivers/usb/gadget/function/f_acm.c file of the Linux kernel’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the acmbind function in the drivers/usb/gadget/function/facm.c file of the Linux device driver framework is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Avigilon ACM - Host Header Injection

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. id: CVE-2025-56266 info: name: Avigilon ACM - Host Header Injection author: DhiyaneshDK severity: medium description: | A Host Header Injection vulnerability in...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004416)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004416 advisory. In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003949)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003949 advisory. In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002558)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002558 advisory. The acmprobe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer...

ROS-20260114-7324

A vulnerability in the drivers/usb/class/cdc-acm.c component of the Linux kernel is related to errors in processing length parameters. Exploitation of the vulnerability could allow an attacker to affect data integrity...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000788)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000788 advisory. The acmprobe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: facm: Refactor the bind path to use free After a bind/unbind cycle, the acm-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This leads to...

CVE-2025-68919

CVE-2025-68919 affects Fujitsu Fsas Technologies ETERNUS SF ACM/SC/Express (DX/AF Management Software). The issue arises because maintenance data collected by the system can be accessed by a non-admin principal, potentially exposing data and impacting confidentiality (C), with limited integrity/a...

CVE-2025-68919: Insertion of Sensitive Information into Log File

Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express DX / AF Management Software before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to potentially affect system confidentiality, integrity, and...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-28048)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-28048 advisory. - netfilter: nftables: reject duplicate device on updates Pablo Neira Ayuso Orabug: 38744086 CVE-2025-38678 - PCI: rcar: Demote WARN to...

CLSA-2025-1763734783 kernel: Fix of 64 CVEs

media: bttv: fix use after free error due to btv-timeout timer CVE-2023-52847 - firmware: armscpi: Ensure scpiinfo is not assigned if the probe fails CVE-2022-50087 - wifi: mwifiex: Fix OOB and integer underflow when rx packets CVE-2023-53226 - vsock: Fix transport TOCTOU CVE-2025-38461 - ALSA:...

SUSE CVE-2025-40094

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: facm: Refactor bind path to use free After an bind/unbind cycle, the acm-notifyreq is left stale. If a subsequent bind fails, the unified error label attempts to free this stale request, leading to a NULL pointer...