CVE-2026-28984

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-65338

A memory handling issue in WebKitGTK and Safari allows processing maliciously crafted web content to cause an unexpected Safari crash . The vulnerability has been addressed in Safari 26.6.1 , iOS 18.7.10 , iPadOS 18.7.10 , iOS 26.6.1 , iPadOS 26.6.1 , macOS Tahoe 26.6.2 , and visionOS 27 . Remedi...

CVE-2026-65338

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-65338

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-65338

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-65338

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

CVE-2026-64849

MLflow versions before 3.15.0 expose an unauthenticated full-read SSRF: _validate_webhook_url() in mlflow/utils/validation.py validates only the original URL while mlflow/webhooks/delivery.py follows HTTP redirects without IP pinning, letting attackers reach internal/cloud-metadata endpoints. CIR...

CVE-2026-28753 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

MINI-RCWM-XWXR-GH9M

Bulletin has no description...

CVE-2026-72062

A flaw was found in the Linux kernel's gpio: mt7621 module. This vulnerability arises from non-atomic operations on shared interrupt trigger state. When mediatekgpioirqtype is called concurrently for different interrupts on the same bank, it can lead to an overwrite of configurations. This...

DEBIAN-CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

NPM: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

NPM: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling vulnerability discovered by ? in WordPress Npm epetherpad-lite versions = 1.8.14...

USN-8640-1 engrampa vulnerability

It was discovered that Engrampa incorrectly handled symbolic links when extracting certain archives. An attacker could possibly use this issue to write arbitrary files and execute arbitrary code...

USN-8640-1: Engrampa vulnerability

It was discovered that Engrampa incorrectly handled symbolic links when extracting certain archives. An attacker could possibly use this issue to write arbitrary files and execute arbitrary code...

USN-8639-1: libpng vulnerabilities

Patrick Keshishian discovered that libpng incorrectly handled certain text chunks. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2016-10087 It was discovered that libpng incorrectly handled certain malformed images. An...

USN-8639-1 libpng, libpng1.6 vulnerabilities

Patrick Keshishian discovered that libpng incorrectly handled certain text chunks. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2016-10087 It was discovered that libpng incorrectly handled certain malformed images. An...

SUSE CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-12629

The Zephyr RTOS ARM PL011 UART driver's pl011_isr() only cleared CTS interrupts, never writing UARTICR for error bits. An attacker controlling a serial peer can inject line errors to trigger a permanent interrupt-storm livelock (availability DoS), CVSS 4.6 (MEDIUM). Fix commit: https://github.com...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-72486

A flaw was found in the Linux kernel's mtk-adsp mailbox driver. During device teardown, if the Sound Open Firmware SOF audio driver fails to initialize, a timing issue can occur where an interrupt is processed after the associated memory has been released. This Use-After-Free UAF vulnerability ca...