CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

CVE-2026-42392

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: lapack (UTSA-2026-032438)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032438 advisory. An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version...

PT-2026-83068

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can send an invalid IMAP URLFETCH command, causing the system to include uninitialized memory in the error response returned to the client. This can lead to the...

CVE-2026-81574

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canarie...

EUVD-2026-66981

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canarie...

CVE-2026-81574 Format String Vulnerability in Logger

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canarie...

SUSE CVE-2026-79020

Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. Chromium security severity: Medium...

SUSE CVE-2026-79040

Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-79239

Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-81574: Use of Externally-Controlled Format String

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canarie...

MiracleLinux 8 : nginx:1.24 (AXSA:2026-1679:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1679:01 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...

CVE-2026-79223

An integer overflow flaw was found in the Chromium component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=530816571...

CVE-2026-78969

A flaw was found in Google Chrome. An uninitialized resource in the Video component could allow a remote attacker to read sensitive information. This can be achieved by tricking a user into visiting a specially crafted HTML page, potentially leading to unauthorized data access within the browser'...

K000163091: JSON processor vulnerability CVE-2026-39979

Security Advisory Description jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jvparsesized API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jvstringfmt,...

CVE-2026-79270

A flaw was found in chromium-browser. A remote attacker could exploit an uninitialized resource vulnerability in ANGLE by crafting a malicious HTML page. This could allow the attacker to read sensitive memory outside of the browser's security sandbox...

CVE-2026-80543

CVE-2026-80543 affects the Linux kernel on s390 architectures, specifically the s390/zcrypt subsystem. The vulnerable functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() copy a user-space message into a kernel buffer based on its length, but subsequent processing requires...

CVE-2026-80543 s390/zcrypt: Pad trailing CCA or EP11 message with zeros

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrbmsgtotype6cprbmsgx and xcrbmsgtotype6ep11cprbmsgx copy the user space message into a kernel buffer based on the message length. But on further...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.9 Vulnerability Details CVEID:CVE-2026-54058 DESCRIPTION: Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path,...

nginx security update

An update is available for nginx. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other protocols, with a foc...