PT-2026-65099

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in the file-sgi plugin when processing RLE-compressed SGI images. The plugin reads image header dimensions ysize and zsize as 16-bit unsigned integers. If a crafted file sets both...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths when processing SVG images embedded through data: URIs, where the second SVG processing pass performed by php-svg-lib does not enforce the same security restrictions, allowing an...

CVE-2026-64527 drm/hyperv: validate VMBus packet size in receive callback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

EUVD-2026-49036

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

CVE-2026-64516

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access...

CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-64475

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

SUSE CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:3221-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3221-1 advisory. This update for MozillaFirefox fixes the following issue: - Firefox Extended Support Release 140.13.0 ESR MFSA...

Linux Distros Unpatched Vulnerability : CVE-2026-16386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

Linux Distros Unpatched Vulnerability : CVE-2026-16385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

Linux Distros Unpatched Vulnerability : CVE-2026-16384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

Linux Distros Unpatched Vulnerability : CVE-2026-16398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16398 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2026-16393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16393 Note that Nessu...

Linux Distros Unpatched Vulnerability : CVE-2026-16358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153,...

Linux Distros Unpatched Vulnerability : CVE-2026-16376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16376 Note that Nessus relies on...

Linux Distros Unpatched Vulnerability : CVE-2026-16357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, a...

CVE-2026-16280 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the pngwritechunk process. An attacker can cause heap memory corruption, process crashes, or potentially achieve arbitrary code execution by supplying a crafted PNG image containing a malicious eXIf chunk...