CVE-2026-53199 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53199 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53213 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53213 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53253 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53253 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53357 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53357 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-56404 affecting package expat for versions less than 2.8.2-1

CVE-2026-56404 affecting package expat for versions less than 2.8.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48930 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48930 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52923 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52923 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions

A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...

CVE-2026-59882 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...

kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result

A flaw was found in the Linux kernel's Wi-Fi mac80211 subsystem. The ieee80211invokefastrx function uses a static variable for rxresult, which is shared across concurrent calls. This can lead to incorrect processing of Wi-Fi packets, where a packet might be mishandled or its status incorrectly...

CVE-2026-59870

js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem to perform a linear duplicate-key scan on every insertion, causing On^2 CPU consumption when yaml.load parses a crafted...

CVE-2026-55873 SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and fails open, allowing an authenticated...

CVE-2026-15036 Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/listall.go of the component gitspaces Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotel...

BIT-MLFLOW-2026-13484 MLflow Experiment-scoped Label Schema CRUD API authorization

A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...

USN-8517-1 clamav vulnerabilities

It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. CVE-2026-20213, CVE-2026-20214, CVE-2026-20217 It was discovered that ClamAV incorrectly handled certain 7z archive files...

CVE-2026-56362 ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization

ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting a...

DEBIAN-CVE-2026-58382

Bulletin has no description...

SUSE-SU-2026:22553-1 Security update for curl

This update for curl fixes the following issues - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie bsc1268409. - CVE-2026-8927: env-set cross-proxy Digest auth state leak...

MINI-X6RH-925X-JQ96

Bulletin has no description...

Important: Red Hat Security Advisory: 389-ds-base security update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...