Linux Distros Unpatched Vulnerability : CVE-2026-64297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The...

PT-2026-64518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the decompression module where the return value of the module extend max pages function is not checked. This function internally calls kvrealloc and returns -ENOMEM up...

CVE-2026-64492: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devmiiotriggerregister tmp006probe allocates the DRDY trigger with devmiiotriggeralloc but registers it with plain iiotriggerregister. The driver has no .remove callback, so on module unload the...

PT-2026-64533

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pcrypt component of the crypto subsystem. The system installs the pcrypt aead done callback on a child AEAD request before attempting submission via padata. When...

PT-2026-64632

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter ebtables component, the update counters and compat update counters functions forward a user-supplied 32-byte table name to find table lock without NUL-termination. When ...

PT-2026-64760

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The QAT driver exposes a character device qat adf ctl that utilizes IOCTLs Input/Output Control for device configuration, start, stop, status query, and enumeration. This interface...

PT-2026-64528

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the crypto ccp component where the system could attempt to initialize SNP during an ioctlSNP CONFIG call. If SEV initialization fails while KVM is running normal VMs, a...

Exploit for CVE-2026-64600

VQ-RefluxCore: Kernel Vulnerability Assessment & Research Fram...

PYSEC-2026-3657

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

PYSEC-2026-3657

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

DEBIAN-CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

UBUNTU-CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2025-71408

The CVE-2025-71408 issue affects NLTK up to version 3.9.2 (pre-3.9.3). The vulnerability lies in nltk.collocations’ main path, where command‑line arguments are passed directly to eval() to form BigramAssocMeasures suffixes without a allowlist or sanitization, enabling an attacker who can control ...

CVE-2025-71408

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.17-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.1-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...