UBUNTU-CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

CVE-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

EUVD-2026-57788

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

PT-2026-71670

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description An issue exists where the validation exception handler in vllm/entrypoints/openai/server utils.py converts FastAPI RequestValidationError objects using strexc, and the sanitize message function in...

PT-2026-71779

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

PT-2026-71487

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Untrusted data inclusion in psql COPY may allow a server...

ROS-20260813-73-0046

The vulnerability in freerdp3 is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260813-73-0052

The vulnerability in uriparser is related to numerical truncation errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-71632

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A logic error exists in the handling of the --max-alloc configuration. When a sender or configuration sets --max-alloc=0, allocation sanity checks are entirely disabled instead of enforcing a zero-byte...

ALSA-2026:54575 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

ALSA-2026:54576 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)

A flaw was found in the netty-codec-compression component of Netty. This vulnerability, caused by a logic error in the bzip2 decoder, allows a remote attacker to send specially crafted bzip2-compressed data. Processing this malformed data can trigger an infinite loop, causing the decoder thread t...

SUSE CVE-2026-71391

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

CVE-2025-59322

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext...

CVE-2026-73288

CVE-2026-73288 affects RustFS prior to 1.0.0-rc.1, where Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs misclassifies ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration. This allows objects under COMPLIANCE retention...

SUSE-SU-2026:3598-1 Security update for dracut

This update for dracut fixes the following issue: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432...

Sensitive Information Disclosure

Apache Camel Netty HTTP component is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of exception responses, where processing errors return full Java stack traces instead of suppressing them, allowing attackers to obtain sensitive information such as...