CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

MINI-HG25-8WHQ-MGQC

Bulletin has no description...

MINI-4Q44-CV7V-CJ88

Bulletin has no description...

DRUPAL-CONTRIB-2026-079

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-078

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DEBIAN-CVE-2026-59882

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost to disagree with the URI authority used for security ...

CVE-2026-59731

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI operation and can resolve the request to a...

EUVD-2026-42332

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcprxstatemachine function net/tcp.c that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payloadlen to become negative...

CVE-2026-53352 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53352 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53357 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53357 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53291 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53291 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48930 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48930 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53034 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53034 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53056 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53056 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52970 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52970 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52925 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52925 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52923 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52923 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53253 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53253 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions

A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the...

kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result

A flaw was found in the Linux kernel's Wi-Fi mac80211 subsystem. The ieee80211invokefastrx function uses a static variable for rxresult, which is shared across concurrent calls. This can lead to incorrect processing of Wi-Fi packets, where a packet might be mishandled or its status incorrectly...