CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-63861 spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove callback mtksnandprobe registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action aft...

CVE-2026-63861

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove callback mtksnandprobe registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action aft...

OESA-2026-3053 yelp security update

Yelp is the help viewer in GNOME. It natively views Mallard, DocBook, man, info, and HTML documents. It can locate documents according to the freedesktop.org help system specification. Security Fixes: A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation...

OESA-2026-3046 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code ...

OESA-2026-3038 NetworkManager security update

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHC...

OESA-2026-2988 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or...

OESA-2026-2987 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or...

OESA-2026-2985 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

PT-2026-61178

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mtk-snfi SPI driver where the on-host NAND ECC engine is registered during the mtk snand probe function, but the corresponding teardown process is missing from bot...

PT-2026-61291

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where hci dev close sync can be called during the reset path. Failure to set HCI CMD DRAIN WORKQUEUE during device close can lead to the queuin...

Linux Distros Unpatched Vulnerability : CVE-2026-53382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: vidtv: fix NULL pointer dereference in vidtvmuxpushsi syzbot reported a general protection fault in vidtvpsitspsiwriteinto 1. vidtvmuxgetpidctx can retur...

PT-2026-61153

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 4.1.0 Description The software fails to treat a literal backslash character U+005C as an authority delimiter. Because Node's native WHATWG URL parser normalizes backslashes to forward slashes for specific scheme...

Linux Distros Unpatched Vulnerability : CVE-2026-53403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: Fix fbnewmodelist to prevent null-ptr-deref in fbvideomodetovar info-var, a framebuffer's current mode, is expected to have a matching entry in...

PT-2026-61320

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCSI core where the scsi run host queues function fails to process devices in a partially removed state, such as SDEV CANCEL. This occurs because the function reli...

PT-2026-61388

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nvme free host mem function. The function frees dev-hmb sgt using dma free noncontiguous but fails to clear the pointer. If nvme free host mem is...

PT-2026-61232

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap read occurs during HCP header parsing. The functions nfc hci recv from llc and nci hci data received cb access packet-header from skb-data without verifying that th...

Exploit for Use After Free in Linux Linux_Kernel

smt878u-ionstack-poc Pure-C, host-assisted re-root proof of c...

Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Linux Distros Unpatched Vulnerability : CVE-2026-50151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a...