PT-2026-98851

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A use-after-free issue exists in the 9pfs subsystem. A race condition occurs between the main thread and a worker thread during the concurrent processing of Tlcreate and Twalk requests. This...

CVE-2026-96812: Exposure of Resource to Wrong Sphere

Improper Exposure of Resource to Wrong Sphere in the host file helper gofer in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a...

CVE-2026-93834: Use After Free

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

Linux Distros Unpatched Vulnerability : CVE-2026-97529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-97951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: iscsi: Fix hang for aborted WRITEPENDING commands When a LUNRESET aborts a WRITE command that is in the TRANSPORTWRITEPENDING state, the target co...

Linux Distros Unpatched Vulnerability : CVE-2026-97931

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE s...

Linux Distros Unpatched Vulnerability : CVE-2026-98154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DM...

Linux Distros Unpatched Vulnerability : CVE-2026-97971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a...

Linux Distros Unpatched Vulnerability : CVE-2026-98093

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfre...

Security update for gitoxide (moderate)

openSUSE security update: security update for gitoxide ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21955-1 Rating: moderate References: bsc1281749 Cross-References: CVE-2026-91986 CVSS scores: CVE-2026-91986 SUSE : 5.4...

Linux Distros Unpatched Vulnerability : CVE-2026-97585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to...

CVE-2023-41080

脆弱: http://localhost:8081//secret.html;@example.com 任意のWebサイトにリダイレクトされます（この場合は、https://example.com）。 修正済み: http://localhost:8082//secret.html;@example.com 参照: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

Malicious code in vercel-runtime-python (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6 The package presents itself as a Vercel Python runtime helper but ships no runtime functionality. Its only substantive code path is a public function...

GHSA-4HQ8-GPF5-8P68 Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

EUVD-2026-39807

Podman: Malformed Image can trick podman run into leaking host environment variables into the container...

AZL-105107 CVE-2026-96748 affecting package python-pymongo 4.2.0-9

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

DEBIAN-CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

GHSA-FGMF-7RF8-M6VF ZITADEL: Actions V1 sandbox escape: host file read via require()

Summary A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript require module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials including the Login Client PAT and...