CVE-2026-47837

Spring Cloud Config Server is vulnerable to Missing Authentication for Critical Function via its /monitor endpoint, which does not validate incoming webhook requests. An attacker can trigger unauthorized actions or cause unintended effects by sending crafted webhook requests to this endpoint. Aff...

CVE-2026-15742

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

AZL-97698 CVE-2026-80565 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devmqceregisteralgs If ops-registeralgs fails, the error path repeatedly calls the same ops-unregisteralgs from the failed registration. Use the loop index to unregister the previously registered...

CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-74738 regmap: sdw-mbq: don't call an unset readable_reg callback

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a Regular Expression Denial of Service vulnerability due to Python idna library

Summary The idna library is used by IBM Integrated Analytics System as a Python library for Internationalized Domain Names in Applications IDNA encoding and decoding. CVE-2026-45409 affects idna versions prior to the fix, where the idna.encode function is vulnerable to Regular Expression Denial o...

glibc: Fix out-of-bounds array write in tdelete

A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the tdelete function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of...

PT-2026-82118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the regmap sdw mbq poll busy function where the system attempts to call the readable reg callback without verifying if it is set. Because this callback is optional,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104774)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104774 advisory. Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is t...

CVE-2026-74738: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

PT-2026-81938

mp Enddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-81957

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

ROS-20260826-73-0021

The vulnerability of the aspeedsocinfoinit function in the drivers/soc/aspeed/aspeed-socinfo.c module of the Linux SOC kernel driver is related to improper memory release. Exploiting this vulnerability can allow an attacker to cause a system failure...

CVE-2026-80198: Protection Mechanism Failure

Kimai versions before 2.56.0 fail to restrict the config Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng12 (UTSA-2026-093154)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093154 advisory. The pngerr function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL...

The vulnerability of the bpf_kprobe_multi_link_attach() function in the kernel/trace/bpfTrace.c module, which supports kernel tracing in Linux operating systems, allows a hacker to trigger a system failure.

The vulnerability of the bpfkprobemultilinkattach function in the kernel/trace/bpfTrace.c module, which supports kernel tracing in Linux operating systems, is related to the use of a initially dangerous function. Exploiting this vulnerability could allow an attacker to cause a system failure...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104761)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104761 advisory. Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes...

ROS-20260826-73-0001

The vulnerability of the rmapremove function in the KVM virtualization subsystem of the Linux operating system is related to the use of memory after it is freed, as a result of a pointer being dereferenced that has reached its expiration time. Exploiting this vulnerability can allow an attacker t...

The vulnerability of the Lz4Decode function in the NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp component of the SquashFS compiler, a 7-Zip-based archive compressor, allows a hacker to disclose protected information and cause a service failure.

The vulnerability of the Lz4Decode function in the NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp component of the SquashFS compressor, a 7-Zip-based archive compressor, involves reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104771)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104771 advisory. Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user...