SUSE-SU-2026:22896-1 Security update for pam

This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

...

CVE-2026-64033

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rtrs module. An incorrect cleanup sequence during path file creation can lead to a use-after-free vulnerability. This issue occurs when an object is deallocated prematurely, and subsequent...

CVE-2026-64016

A flaw was found in the Linux kernel's ksmbd component, which handles file sharing. When a durable network connection is re-established, an error in managing the lifetime of file objects can occur. This can lead to a situation where a file object is released from memory while still being...

EUVD-2026-47274

Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft component: Cash Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN...

EUVD-2026-46725

Vulnerability in the Oracle Performance Management product of Oracle E-Business Suite component: Appraisals. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Performance...

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability. This vulnerability ...

PT-2026-63338

Denial-of-Service in Thinkst Applied Research OpenCanary MongoDB module allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only...

The vulnerability in the mm/damon/sysfs.c module of the Linux kernel’s memory management subsystem allows a hacker to cause a system failure.

The vulnerability in the mm/damon/sysfs.c module of the Linux kernel’s memory management subsystem relates to the distribution of resources without any restrictions or controls. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE SLES12 Security Update : pam (SUSE-SU-2026:3162-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3162-1 advisory. This update for pam fixes the following issue - CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290...

PT-2026-63541

Name of the Vulnerable Software and Affected Versions PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 3.2.0 Description A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails t...

MiracleLinux 8 : nginx:1.24 (AXSA:2026-1325:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1325:01 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Tenable has extracted t...

ROS-20260722-73-0037

The vulnerability of the Blink module in Google Chrome and Microsoft Edge browsers is related to external control over a web parameter that is assumed to be immutable. Exploiting this vulnerability could allow an attacker to cause service interruptions...

PT-2026-63385

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.25.0 through 1.25.1 Description A memory corruption issue exists when the software is under pressure and configured with an access-control-view and either the respip or rpz modules, alongside a module capable of...

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery...

CVE-2026-16551: Loop with Unreachable Exit Condition

Denial-of-Service in Thinkst Applied Research OpenCanary MongoDB module allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only...

RHEL 8 : evince (RHSA-2026:43398)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:43398 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

The vulnerability of the crypto_free_instance() function in the crypto/algapi.c module of the Linux kernel’s cryptographic subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the cryptofreeinstance function in the crypto/algapi.c module of the Linux kernel’s cryptographic subsystem is related to situations where there is a competition for resources between different contexts. Exploiting this vulnerability could allow an attacker to compromise the...

kernel security, bug fix, and enhancement update

6.12.0-211.37.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

The vulnerability of the kcm_sendmsg() function in the net/kcm/kcmsock.c module, which is part of the Linux kernel’s networking functions, allows a hacker to cause a service failure.

The vulnerability of the kcmsendmsg function in the net/kcm/kcmsock.c module, which is part of the Linux kernel’s networking functions, is related to deficiencies in error handling. Exploiting this vulnerability could allow an attacker to cause a service failure...