CVE-2026-55626 xrdp: No authentication required with Xvnc backend on RHEL 9

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this...

CVE-2026-64073

A flaw was found in the Linux kernel, specifically within the irqwork subsystem when running on systems configured with PREEMPTRT. This vulnerability is a use-after-free, where the system attempts to access memory after it has been released. A local attacker could exploit this timing issue to cau...

CVE-2026-64047

A flaw was found in the Linux kernel's Transport Layer Security TLS component. An off-by-one error in how memory is managed for network messages can lead to memory corruption. This vulnerability may allow a local attacker to cause the system to crash, resulting in a denial of service DoS...

CVE-2026-63830

A flaw was found in the Linux kernel's skmsg networking component. This vulnerability arises when the sg.copy bitmap, which controls memory access permissions, is not properly maintained during data transformations. This can allow a local attacker to bypass memory protection mechanisms, enabling...

USN-8569-1: Linux kernel (HWE) vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

USN-8567-1: Linux kernel vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

CVE-2026-64042

A flaw was found in the Linux kernel's vfio/pci subsystem. This vulnerability occurs because the Direct Memory Access Buffer DMABUF export mechanism does not adequately verify if Base Address Register BAR resources are properly reserved before allowing access. A local attacker could exploit this ...

CVE-2026-64084

A flaw was found in the Linux kernel's hardware monitoring hwmon subsystem, specifically within the pmbus/adm1266 driver. This vulnerability involves an out-of-bounds memory access, where the system attempts to read or write data beyond the allocated memory region. A local attacker could exploit...

CVE-2026-53378

A flaw was found in the Linux kernel's Direct Rendering Manager DRM color operation module drm/colorop. This vulnerability arises from improper reference tracking of blob properties during state duplication, destruction, and reset operations. An attacker with local access could potentially exploi...

CVE-2026-64041

A flaw was found in the Linux kernel's ASoC fs210x audio codec driver. An incorrect use of the strscpy function in fs210xeffectsceneinfo can lead to a buffer overflow. This occurs when a string is copied without proper size validation, potentially allowing a local attacker to cause a denial of...

CVE-2026-64109

A flaw was found in the Linux kernel's afunix UNIX domain sockets component. A race condition in the unixstreamdatawait function allows a local attacker to trigger a Use-After-Free UAF vulnerability. This occurs because the function peeks at a socket buffer without proper locking, enabling anothe...

dotnet: .NET: Local tampering via improper link resolution

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files...

dotnet: .NET: Local tampering via improper link resolution

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files...

dotnet: .NET: Local tampering via improper link resolution

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files...

PT-2026-61602

Name of the Vulnerable Software and Affected Versions Menyoo 2.0 versions prior to commit 729aa48 Description A directory traversal issue allows a local attacker to execute arbitrary code. This occurs through the Spooner file management, the save, folder, and rename functions of the VehicleSpawne...

OESA-2026-3032 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled...

CVE-2026-9323

The CVE-2026-9323 issue affects the urwid web display backend (urwid/display/web.py), where web session IDs (urwid_id) are created by concatenating two random.randrange(10**9) calls that rely on Python’s Mersenne Twister PRNG. This is not cryptographically secure. An observer collecting ~334 sess...

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...

CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...

CVE-2026-50526

A flaw was found in .NET. This vulnerability, stemming from improper link resolution before file access, allows an authorized local attacker to perform tampering. This could lead to unauthorized modification of data or system files...