Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000827 advisory. The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, whic...

CVE-2026-23494

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL patterns defined vi...

CVE-2025-56226

A flaw was found in the libsndfile library. This issue occurs when encoding MP3 files. During initialization, when an unsupported sample rate is detected, encoding resources are not released within the error-handling path due to an incomplete initialization, impacting system performance and...

CVE-2025-71080

A race condition vulnerability was found in the Linux kernel's IPv6 routing subsystem on PREEMPTRT kernels. When rt6getpcpuroute returns NULL and the task is preempted, another task can install a per-CPU route entry. When the original task resumes and attempts cmpxchg in rt6makepcpuroute, the...

CVE-2025-71081

In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the setsync callback fails during DAI probe. Make sure to drop the referen...

SUSE CVE-2025-68776

In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prpgetuntaggedframe prpgetuntaggedframe calls pskbcopy to create frame-skbstd but doesn't check if the allocation failed. If pskbcopy returns NULL, skbclone is called with a NULL pointer,...

SUSE CVE-2025-68813

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in ipvsgetoutrt calls dstlinkfailure without ensuring skb-dev is set, leading to a NULL pointer dereference in fibcomputespecdst when ipv4linkfailure attempts t...

CVE-2025-68813

A NULL pointer dereference vulnerability was found in the Linux kernel's IPVS IP Virtual Server implementation. In ipvsgetoutrt, when route lookup fails, dstlinkfailure is called with skb-dev set to NULL. The subsequent call chain through ipv4linkfailure to fibcomputespecdst dereferences skb-dev,...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003433)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003433 advisory. A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001976)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001976 advisory. net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to...

Failed to create a restore point: PostgreSQL database operation failed multiple times with transient error.

Challenge After upgrading to Veeam Backup for Microsoft 365 8.2 or 8.3, jobs fail with the erorr: Failed to create a restore point: PostgreSQL database operation failed multiple times with transient error. Cause This issue occurs because various one-time PostgreSQL queries that the software...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003526)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003526 advisory. In the Linux kernel through 4.14.13, the rdscmsgatomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leadin...

Svelte security vulnerabilities

Svelte is an open-source approach to building web applications. Versions of Svelte from 5.3.0 to 5.6.1 have security vulnerabilities. These vulnerabilities stem from the type array hydration process not checking input assumptions properly, which can lead to denial-of-service attacks...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002323 advisory. net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002302)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002302 advisory. The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, whic...

CVE-2025-68776

A flaw was found in the Linux kernel's High-availability Seamless Redundancy HSR networking component. This vulnerability occurs due to a missing NULL pointer check in the prpgetuntaggedframe function. An attacker could exploit this by triggering a scenario where a memory allocation fails, leadin...

CVE-2026-20824

Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally...

Weblate leaks information via screenshots

Impact The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. Patches https://github.com/WeblateOrg/weblate/pull/17516 References Thanks to Lukas May and Michael Leu...

CVE-2025-71141

In the Linux kernel, the following vulnerability has been resolved: drm/tilcdc: Fix removal actions in case of failed probe The drmkmshelperpollfini and drmatomichelpershutdown helpers should only be called when the device has been successfully registered. Currently, these functions are called...

CVE-2025-71130

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Zero-initialize the eb.vma array in i915gemdoexecbuffer Initialize the eb.vma array with values of 0 when the eb structure is first set up. In particular, this sets the eb-vmai.vma pointers to NULL, simplifying...