CVE-2026-71225 affecting package libkcapi for versions less than 1.5.1-1

CVE-2026-71225 affecting package libkcapi for versions less than 1.5.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-74982 Denial-of-service in the Widget component

Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

EUVD-2026-60695

Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74934

Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-75845

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the setserversetting MCP server-level tool. SetServerSettingTool.execute gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-roo...

EUVD-2026-60584

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

CVE-2026-74903 SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

CVE-2026-72382

A flaw was found in ksmbd in the Linux kernel. A remote attacker, by sending a specially crafted security descriptor with an undersized Discretionary Access Control List DACL during an SMB2SETINFO operation, can trigger an integer underflow. This underflow leads to excessive memory allocations fo...

CVE-2026-72231

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking module of the Linux kernel. An incorrect check during the handling of TT Topology Table requests can prevent the proper cleanup of request nodes when send buffer allocation fails. This can lead to a remote attacker...

RHSA-2026:55803 Red Hat Security Advisory: haproxy security update

Bulletin has no description...

RHSA-2026:55802 Red Hat Security Advisory: haproxy security update

Bulletin has no description...

RHSA-2026:54515 Red Hat Security Advisory: kernel security update

Bulletin has no description...

CVE-2026-72264

A flaw was found in the fbdev: tridentfb component of the Linux kernel. A memory leak occurs in the tridentpciprobe function because memory allocated for the modelist is not properly freed in certain error paths. This could allow a local attacker to exhaust available memory resources, leading to ...

CVE-2026-72436

A flaw was found in the netfilter: ipset component of the Linux kernel. This vulnerability occurs because a specific operation, testbit, is used in a way that lacks proper safeguards when multiple processes access shared data simultaneously. This can lead to situations where the system processes...

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

CVE-2026-72263

A flaw was found in the Linux kernel's ASoC Audio System on Chip Sound Open Firmware SOF topology component. When a topology filename contains "dummy" and a specific counter is zero, the sndsofloadtopology function fails to deallocate previously assigned memory. This oversight results in a memory...

SUSE-SU-2026:3635-1 Security update for python

This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...

CVE-2026-72377

A flaw was found in the Linux kernel's Andrew File System AFS module. When fscache is enabled, AFS symlinks and mountpoints are incorrectly handled during memory management operations. This can lead to a pointer dereference, which a local attacker could potentially exploit to cause a system crash...

CVE-2026-72182

A flaw was found in the Linux kernel's power supply charger-manager component. A reference count refcount leak occurs within the isfullcharged function. This happens when a reference to the fuel gauge power supply is obtained but not properly released if a specific voltage check succeeds. This...