Security update for gimp (important)

openSUSE security update: security update for gimp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22123-1 Rating: important References: bsc1277594 bsc1277618 bsc1277622 bsc1284473 bsc1284474 bsc1284475 Cross-References: CVE-2026-106061...

PT-2026-128486

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifs remap file range discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio...

CVE-2026-98778: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

Linux Distros Unpatched Vulnerability : CVE-2026-98777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated...

VulnCheck KEV: CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-98682: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

CVE-2026-112059: Out-of-bounds Write

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.0 contains security vulnerabilities. These vulnerabilities stem from binder’s incorrect use of isfailure=false during the cleanup of replaced asynchronous transactions. As a result, the BINDERTYPEFDA cleanup process misinterprets the contents of outdated buffer areas as...

Akai MPC Sample 1.3.0.12 Path Traversal

Akai MPC Sample version 1.3.0.12 contains a path traversal vulnerability in its built-in web server that allows unauthenticated file reads outside the webroot through the USB-C virtual Ethernet interface. https://packetstorm.news/download/236153...

VulnCheck KEV: CVE-2026-33309

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 External Control of File Name, leading to the root architectural issue within LocalStorageService remaining unresolved. Because the underlying...

CVE-2026-112013: Divide By Zero

libtta through 2.3 contains a divide-by-zero vulnerability in ttadecoderinitgetinfo that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the...

WordPress WooCommerce Designer Pro 1.9.26 Arbitrary File Upload

WordPress WooCommerce Designer Pro versions 1.9.26 and prior contain an unauthenticated arbitrary file upload vulnerability in the wcdpsavecanvasdesignajax handler that may allow remote code execution. https://packetstorm.news/download/236146...

PT-2026-116772

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A file reference leak occurs in the autofs component. When the autofs fill super function fails before clearing the AUTOFS SBI CATATONIC flag—such as when find get pid fails due to an...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

PT-2026-116620

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...

PT-2026-116590

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

CVE-2026-110365: Missing Authorization

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

CVE-2026-98553: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.0 contains security vulnerabilities. These vulnerabilities arise when binder directly calls kfree to release outdated transactions during the TFUPDATETXN transaction, replacing frozen processes. This bypasses the binderfreetxnfixups function, resulting in a leak of...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791972286)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791972286 advisory. - rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who c...