ALSA-2026:66355 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after deleting a port group CVE-2026-74480 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

MAL-2026-16104 Malicious code in @nexustechpro/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab @nexustechpro/baileys is a fork of the WhatsApp library baileys in which lib/Socket/chats.js 270 KB is heavily obfuscated obfuscator.io-style rotatin...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

Denial-Of-Service (DoS)

io.micrometer, micrometer-tracing-bridge-brave is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of incoming baggage headers, which allows an attacker to send specially crafted or excessive baggage data that causes unbounded object allocation, potentially...

Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to Improper Encoding or Escaping of Output

Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34479 Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard,...

Security Bulletin: IBM Db2 Bridge is vulnerable due to baseline-browser-mapping, sqlparse, cryptography, Browserslist (CVE-2026-45819,CVE-2026-84305,CVE-2026-69247,CVE-2026-73088,CVE-2026-73089,CVE-2026-54284,CVE-2026-59893,CVE-2026-59894,CVE-2026-71491)

Summary baseline-browser-mapping, sqlparse, cryptography, Browserslist is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5 and new Fix pack was release to address the issue. Vulnerability...

RLSA-2026:64770 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage...

kernel-rt security update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

The vulnerability of the function batadv_bla_send_claim() in the net/batman-adv/bridge_loop_avoidance.c module, which is part of the network functions of the Linux operating system’s kernel, allows a hacker to trigger a service failure.

The vulnerability of the batadvblasendclaim function in the net/batman-adv/bridgeloopavoidance.c module, which is part of the network functions of the Linux operating system’s kernel, relates to the use of pointers. Exploiting this vulnerability could allow a malicious actor to cause service...

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage CVE-2026-53002 kernel: netfilter: synproxy: refresh tcphdr after...

CVE-2026-86083

n8n , an open-source workflow automation platform, is affected by a sandbox escape in its legacy expression engine. The root cause is that the engine called the mutable global JSON.stringify while generating source text for synthetic string literals and timezone interpolation. A crafted expressio...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-86711

electerm versions before 5.3.15 are affected by an arbitrary command execution vulnerability in the runGlobalAsync Electron IPC handler (src/app/lib/ipc.js). The handler exposes over 40 main-process functions without a function-name allowlist or sender validation, allowing renderer-side script ex...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-78997

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

CVE-2026-78997

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314 ) is vulnerable to a Universal Cross-Site Scripting (UXSS) flaw. The issue stems from a reflected XSS on the bridge-whitelisted domain mtmsg.uc.cn, which allows attackers to access the privileged ucapi JavaScript bridge. Speci...

EUVD-2026-72957

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...

PT-2026-87176

UC Browser for Android package com.UCMobile.intl, version 13.7.8.1314 contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain via a reflected XSS th...