SUSE CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

SUSE CVE-2026-64538

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6nhmtuchange. fib6nhmtuchange re-fetches idev via in6devgetarg-dev and dereferences idev-cnf.mtu6 without a NULL check. addrconfifdown clears dev-ip6ptr with RCUINITPOINTER after rt6disableip has...

SUSE CVE-2026-64540

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...

SUSE CVE-2026-64541

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

SUSE CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a cross-site request forgery (CVE-2026-14980, CVE-2026-2482)

Summary IBM WebSphere Application Server Liberty is affected by a cross-site request forgery vulnerability with the collectiveController-1.0 enabled. Vulnerability Details CVEID:CVE-2026-14980 DESCRIPTION: IBM WebSphere Application Server Liberty is vulnerable to cross-site request forgery which...

Security Bulletin: IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528 )

Summary IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details CVEID:CVE-2026-14512 DESCRIPTION: IBM WebSphere Application Server traditional is vulnerable to pre-authentication unsafe deserialization which could allo...

CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service (CVE-2026-16192)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with the restConnector-1.0 or restConnector-2.0 enabled. Vulnerability Details CVEID:CVE-2026-16192 DESCRIPTION: IBM WebSphere Application Server Liberty is affected by a denial of service...

Security Bulletin: IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)

Summary IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details CVEID:CVE-2026-14974 DESCRIPTION: IBM WebSphere Application Server traditional could allow a remote attacker to execute arbitrary...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)

Summary IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details CVEID:CVE-2026-14976 DESCRIPTION: IBM WebSphere Application Server Liberty is affected by remote code...

Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server is affected by a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2026-14446 DESCRIPTION: IBM WebSphere Application Server is vulnerable to broken access control/privilege escalation in the administrative console. CWE:CWE-306: Missing...

Security Bulletin: IBM WebSphere Application Server is affected by an authentication bypass (CVE-2026-16184)

Summary IBM WebSphere Application Server is affected by an authentication bypass. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. CWE:CWE-862: Missing...

CVE-2026-59878

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done...

Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.63 fixes various security issues: The following security issues were fixed: CVE-2026-46120: ip6gre: Use cached t-net in ip6erspanchangelink bsc1267893. CVE-2026-46173: exit: prevent preemption of oopsing TASKDEAD task bsc1267723...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: lib/buildid: use __kernel_read() for sleepable context

In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use kernelread for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemapreadfolio". For the sleepable context, convert freader to use kernelread instead of direct page cache...

Security update for the Linux Kernel (Live Patch 41 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.167 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

EUVD-2026-49766

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...

CVE-2026-41874

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...