Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1940)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1940 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it...

Linux Distros Unpatched Vulnerability : CVE-2026-64189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain...

PT-2026-61642

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A race condition exists in the netfilter ipset component between the dump process and the ip set list resize operation. The functions ip set dump do and ip set dump done access inst-ip s...

CVE-2026-64039 drm/msm/snapshot: fix dumping of the unaligned regions

In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code where most of the regions are aligned, but fails for snapshotting of the DSI da...

CVE-2026-64039

CVE-2026-64039 relates to the Linux kernel’s drm/msm/snapshot code, where dumping of unaligned regions caused issues because the snapshotting aligned data segments to 16 bytes. The fix removes length alignment and prints the last registers in the region more accurately; it also addresses a 16x me...

CVE-2026-64039

In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code where most of the regions are aligned, but fails for snapshotting of the DSI da...

CVE-2026-63858

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

EUVD-2026-45759

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERRPTR to genlmsgcancel on prepare failure The goto err label leads to: genlmsgcancelskb, ehdr; return ret; If ethnltsinfopreparedump failed, it has not started a genlmsg. There's nothing to cancel, an...

PT-2026-61356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/msm/snapshot component where the snapshotting code internally aligns data segments to 16 bytes. While this is effective for DPU code, it fails when snapshottin...

PT-2026-61303

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash can occur in the ethtool component when ethnl tsinfo prepare dump fails. The issue arises because the system attempts to call the genlmsg cancel function using an error pointer E...

EUVD-2026-45183

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

CVE-2026-51083

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

CVE-2026-51083

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

CVE-2026-51083

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

CVE-2026-51083

Proxmox VE is affected: incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users with limited privileges to obtain hashed passwords via the cloudinit/dump API. The root cause is an access-control issue in the cloudinit/dump endpo...

CVE-2026-51083

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

PT-2026-60774

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...

CVE-2026-60081

A flaw was found in DBI::ProfileData, a Perl module. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted input. The flaw exists because the software does not properly limit the path index when processing profile dump files, which can lead to...

CVE-2026-47730

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dum...

CVE-2026-47730 Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dum...