SUSE-SU-2026:22926-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director bsc1271629. - CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation,...

kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation

A flaw was found in the Linux kernel's AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression DSC processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a...

glibc security update

An update is available for glibc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The glibc packages provide the standard C libraries libc, POSIX thread librarie...

github.com/moby/buildkit: BuildKit: Denial of Service via malicious client request

A flaw was found in BuildKit. A malicious BuildKit client or frontend can craft a specially designed request, leading to the BuildKit daemon crashing. This vulnerability results in a denial of service DoS, making the BuildKit service unavailable...

EUVD-2026-46642

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

EUVD-2026-46716

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle...

EUVD-2026-46591

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high...

EUVD-2026-46548

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

EUVD-2026-46536

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

EUVD-2026-46527

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services...

CVE-2026-64014

A flaw was found in the Linux kernel's usbtouchscreen driver. A local attacker with a specially crafted USB touch screen device could exploit this vulnerability by sending a malicious interrupt packet with an oversized length field. This improper handling of input lengths can lead to an...

CVE-2026-64013

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface ACPI button driver. This vulnerability occurs because the ACPI General Purpose Event GPE handler is not properly removed when the driver is unloaded. An attacker could potentially trigger an ACPI notify event on a...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through modRMRequired and decode in arch/X86/X86DisassemblerDecoder.c. An attacker can crash any application using a reduced X86 Capstone build by supplying crafted x86/x86-64 input containing a 3DNow! opcode...

PT-2026-63484

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description An off-by-one error exists in the code used to parse MIME headers Multipurpose Internet Mail Extensions for display when forwarding a message, specifically when...

PT-2026-63462

Name of the Vulnerable Software and Affected Versions mongod affected versions not specified Description An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. This...

PT-2026-63389

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.23.0 through 1.25.1 Description When the dns-error-reporting: yes setting is enabled, the software incorrectly processes the EDNS Report-Channel option code 18 from upstream responses. Specifically, it uses the...

PT-2026-63459

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with permissions to execute aggregation pipelines can cause a MongoDB server mongod to crash. This occurs when the $ internalIndexKey aggregation expression is used with...

PT-2026-63460

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A user with read access can cause a Denial of Service DoS by executing a specifically crafted query. By using expressions that generate large arrays, the system...

PT-2026-63469

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Insufficient validation of sort specifications during execution allows a user with read-only privileges to cause the mongod process to terminate abnormally. This is achieved by crafting an...

openSUSE 16 Security Update : ctop (openSUSE-SU-2026:21379-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21379-1 advisory. Changes in ctop embedded dependencies: - CVE-2022-21698: clientgolang: Denial of service using InstrumentHandlerCounter bsc1248710 -...