CVE-2026-43133

Summary: CVE-2026-43133 affects Linux kernel KVM’s nested virtualization (nSVM). When an L2 guest executes VMSAVE/VMLOAD and is not intercepted by L1, KVM may incorrectly use vmcb02 instead of vmcb01 for guest state handling due to an oversight in VMLOAD/VMSAVE emulation after a patch. The root c...

CVE-2026-34601

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator to be inserted into a...

GHSA-F7PM-6HR8-7GGM Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation

Summary When allowedorigins is configured, CheckAllowedOrigins reduces URL-like values to their host component and accepts on host match alone. This makes exact origin policies impossible to express: scheme and port differences are silently ignored. Details CheckAllowedOrigins stores each...

PT-2026-24193

Name of the Vulnerable Software and Affected Versions web-auth/webauthn-lib versions prior to 5.2.4 Description The software’s origin validation process, when using the allowed origins configuration, reduces URL-like values to their host component, accepting matches based solely on the host. This...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Linux Linux_Kernel

SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite...

Azure Linux 3.0 Security Update: kernel (CVE-2024-36965)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-36965 advisory. - In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buff...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004380)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004380 advisory. A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstance...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001462 advisory. A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstance...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004156 advisory. A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstance...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002647)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002647 advisory. The preparevmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the CR8-load exiting and CR8-store exiting L0 vmcs02 control...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003193)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003193 advisory. The preparevmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the CR8-load exiting and CR8-store exiting L0 vmcs02 control...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-46707)

KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICCSGIEL1 registers is trapped to EL2. This plugin only works with Tenable.ot. Please visit...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libarchive (UTSA-2025-986114)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986114 advisory. listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact...

Security update for tiff

This update for tiff fixes the following issues: CVE-2025-9165: local execution manipulation leading to memory leak bsc1248330. CVE-2024-13978: null pointer dereference in component fax2ps bsc1247581 CVE-2025-8534: null pointer dereference in function PSLvl2page bsc1247582. CVE-2025-8961:...

SUSE-SU-2025:03348-1 Security update for tiff

This update for tiff fixes the following issues: - CVE-2025-9165: local execution manipulation leading to memory leak bsc1248330. - CVE-2024-13978: null pointer dereference in component fax2ps bsc1247581 - CVE-2025-8534: null pointer dereference in function PSLvl2page bsc1247582. - CVE-2025-8961:...

SUSE-SU-2025:03346-1 Security update for tiff

This update for tiff fixes the following issues: - CVE-2025-9165: local execution manipulation leading to memory leak bsc1248330. - CVE-2025-8534: null pointer dereference in function PSLvl2page bsc1247582. - CVE-2025-8961: segmentation fault via main function of tiffcrop utility bsc1248117...

CVE-2023-53208 KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state When emulating nested VM-Exit, load L1's TSC multiplier if L1's desired ratio doesn't match the current ratio, not if the ratio L1 is using for L2 diverges from...

CVE-2023-53208 KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state When emulating nested VM-Exit, load L1's TSC multiplier if L1's desired ratio doesn't match the current ratio, not if the ratio L1 is using for L2 diverges from...

Google Pixel 10 Adds C2PA Support to Verify AI-Generated Media Authenticity

Google on Tuesday announced that its new Google Pixel 10 phones support the Coalition for Content Provenance and Authenticity C2PA standard out of the box to verify the origin and history of digital content. To that end, support for C2PA's Content Credentials has been added to Pixel Camera and...

Linux Distros Unpatched Vulnerability : CVE-2011-0115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The DOM level 2 implementation in WebKit, as used in Apple iTunes before 10.2 on Windows and Apple Safari, does not properly handle DOM manipulations associated...