CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences tr-currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from...

CVE-2026-64451 tracing: Fix NULL pointer dereference in func_set_flag()

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences tr-currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from...

EUVD-2026-48908

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

CVE-2026-64364

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

CVE-2026-64364 HID: multitouch: fix out-of-bounds bit access on mt_io_flags

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

PT-2026-64672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the func set flag function. The issue occurs when the function dereferences the tr-current trace flags variable before verifying if the active tracer...

GHSA-J9FC-W3MR-X6MV Budibase: Privilege escalation via public role assignment API missing app-level authorization

Summary Budibase 3.39.19 commit 03fbabae4 is affected by a privilege-escalation / missing-authorization flaw in the public role-assignment API. An app-scoped builder a user who builds only specific apps — user.builder.apps = appA, not a global builder or admin can grant themselves builder access ...

OPENSUSE-SU-2026:21431-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...

SUSE-SU-2026:22938-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...

PT-2026-64070

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

CVE-2026-64793

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to...

EUVD-2026-47817

Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access...

CVE-2026-64793

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to...

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

USN-8586-1 libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. CVE-2026-40333 It was discovered that libgphoto2 did not properly null-terminate buffer...

PT-2026-63504

Name of the Vulnerable Software and Affected Versions Articles Anywhere affected versions not specified Modules Anywhere affected versions not specified Description Content tags in the Articles Anywhere and Modules Anywhere extensions can use ignore flags or property overrides to render restricte...

EUVD-2026-46377

Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in shmgeneric.h with openpath, ORDWR | OCREAT | OCLOEXEC, 0666. The mode is 0666, so under the default umask 022 the file is created mode 06...

EUVD-2026-46370

Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in deque.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

EUVD-2026-46380

Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in intern.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

EUVD-2026-46379

Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in ring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...