Linux Distros Unpatched Vulnerability : CVE-2026-64331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in...

Linux Distros Unpatched Vulnerability : CVE-2026-64349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the...

Linux Distros Unpatched Vulnerability : CVE-2026-64470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe...

Linux Distros Unpatched Vulnerability : CVE-2026-65918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's readfromtensor callback that...

Linux Distros Unpatched Vulnerability : CVE-2026-64293

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in...

Linux Distros Unpatched Vulnerability : CVE-2026-64483

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against t...

Linux Distros Unpatched Vulnerability : CVE-2026-64497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include...

CVE-2026-64497: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELDGET. Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELDGET. The...

CVE-2026-64465: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, xhcifreestreams is called from the hubevent workqueue to free the stream resources. It calls...

EUVD-2026-42650

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal...

Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching

Summary The administrator-configured WEBFETCHFILTERLIST the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch matches hostnames incorrectly, so the filter can be bypassed. Details isstringallowed backend/openwebui/utils/misc.py match...

DEBIAN-CVE-2026-66036

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

EUVD-2026-48727

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

GO-2026-5912 GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber...

EUVD-2026-42629

Open WebUI: Cross-user model-list exposure via static cache key in getallmodels aiocache key= vs keybuilder= misuse...

GHSA-464C-974J-9XM6 AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

Summary The AWS Cloud Development Kit AWS CDK is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified an issue in which explicitly setting encrypted: true on the S3LoggingOptions property of an AWS...

Incorrect Calculation

Overview aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library Affected versions of this package are vulnerable to Incorrect Calculation due to the incorrect mapping of the S3LoggingOptions.encrypted property to the CloudFormation S3LogsConfig.EncryptionDisabled field. An attacker c...

SUSE CVE-2026-16806

Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

ImageMagick: Heap Buffer Over-Write in fx operation

A heap buffer over-write can occur in the fx operation by passing a crafted argument...

AZL-93366 CVE-2026-64241 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...