CVE-2026-53799

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

CVE-2026-53794

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory...

CVE-2026-73508 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord, and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName failed to...

CVE-2026-73507

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated...

CVE-2026-65934 BT122 plaintext pause encryption request causes DOS

An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below...

CVE-2025-62314

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...

OESA-2026-3360 skopeo security update

A command line utility that performs various operations on container images and image repositories Security Fixes: tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse...

OESA-2026-3359 skopeo security update

A command line utility that performs various operations on container images and image repositories Security Fixes: tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse...

OESA-2026-3340 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

OESA-2026-3339 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

OESA-2026-3338 open-iscsi security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files...

OESA-2026-3332 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

CVE-2026-60075

A flaw was found in Date::Manip for Perl. An attacker could exploit a vulnerability in the parsetime function by providing a specially crafted input string containing long sequences of whitespace. This could lead to excessive CPU consumption due to inefficient processing, resulting in a Denial of...

MINI-CVGM-HGHM-566M

Bulletin has no description...

Denial-of-service (DoS)

Spring Cloud Sleuth is vulnerable to a Denial-of-service DoS. The vulnerability is due to specially crafted calls that can trigger a DoS condition when org.springframework.cloud:spring-cloud-sleuth-instrumentation is used with Spring TX instrumentation enabled, allowing an attacker to exploit the...

CLEANSTART-2026-WX98343 Security fixes in grafana 12.4.6-r0

Package grafana version 12.4.6-r0 fixes 4 vulnerabilities: ghsa-jpcw-4wr7-c3vq, ghsa-r277-6w6q-xmqw, ghsa-gcjh-h69q-9w9g, ghsa-259r-337f-4rfw...

CLEANSTART-2026-NI09803 Security fixes in metrics-server 0.8.1-r5

Package metrics-server version 0.8.1-r5 fixes 6 vulnerabilities: CVE-2026-42154, CVE-2026-42151, CVE-2026-44903, ghsa-wg65-39gg-5wfj, ghsa-fw8g-cg8f-9j28...

CLEANSTART-2026-OD61763 Security fixes in boring-registry-fips 0.15.5-r2

Package boring-registry-fips version 0.15.5-r2 fixes 2 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp...

CLEANSTART-2026-ZO84411 Security fixes in prometheus-alertmanager 0.26.0-r0

Package prometheus-alertmanager version 0.26.0-r0 fixes 1 vulnerabilities: CVE-2023-40577...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...