DEBIAN-CVE-2026-53390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smbcheckpermdacl The permission-check ACE walk in smbcheckpermdacl validates the ACE header size and caps sid.numsubauth at SIDMAXSUBAUTHORITIES, but it never checks that ace-size is actually larg...

DEBIAN-CVE-2026-53382

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtvmuxpushsi syzbot reported a general protection fault in vidtvpsitspsiwriteinto 1. vidtvmuxgetpidctx can return NULL, but vidtvmuxpushsi does not check for this before dereferenci...

DEBIAN-CVE-2026-53376

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add upper bound check for numofnodes drm/amdkfd: Add upper bound check for numofnodes in kfdioctlgetprocessaperturesnew. cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f...

OESA-2026-3005 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

OESA-2026-2997 gzip security update

gzip is a single-file/stream lossless data compression utility, where the resulting compressed file generally has the suffix .gz. Security Fixes: GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

DEBIAN-CVE-2026-53370

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Improve validation and configuration of ACR masks Currently there are several issues on the user space ACR mask validation and configuration. - The validation for user space ACR mask attr.config2 is incomplete,...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the OAuth Credential Revoke Handler component. An attacker can gain unauthorized access or perform unauthorized actions by sending crafted requests remotely. Remediation There is no fixed version for django-jet...

EUVD-2026-45426

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released ...

CVE-2026-16210

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.getaction of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-16210 newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.getaction of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-16210

The CVE-2026-16210 entry affects newpanjing simpleui version 2026.01.13, specifically the AjaxAdmin AJAX Endpoint in the file simpleui/admin.py. The issue stems from the function self.get_action, where manipulated input leads to missing authentication, enabling remote exploitation. An exploit has...

CVE-2026-16209

Summary: CVE-2026-16209 affects Gerapy up to 0.9.13. The vulnerability is in an unknown function within gerapy/server/core/views.py, in the Project Upload Endpoint, causing missing authentication. It is a network-accessible issue that can be exploited remotely; the exploit is public. A patch iden...

CVE-2026-16209 Gerapy Project Upload Endpoint views.py missing authentication

A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclos...

EUVD-2026-45408

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu64.go of the component Group Message Handler. Such manipulation leads to missing authorization. The attack can be launched...

Linux Distros Unpatched Vulnerability : CVE-2026-53388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: re-lock request before replacing page cache folio fusetrymovefolio unlocks the request on entry but does not re-lock it on the success path. This means...

PT-2026-61043

A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclos...

Linux Distros Unpatched Vulnerability : CVE-2026-63846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/jpeg: set nouserfence for JPEG v3.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked fr...

PT-2026-61190

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mm struct reference leak in aie2 populate range aie2 populate range jumps back to the again label without calling mmputmm, leaking a reference to the mm struct. Add the missing mmput before jumping to again...

PT-2026-61265

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the L2CAP Bluetooth subsystem within the l2cap chan timeout function. The set chan timer function acquires a reference to the channel using l2cap chan hold...

PT-2026-61049

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released ...