Linux Distros Unpatched Vulnerability : CVE-2026-64359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod ...

EUVD-2026-48399

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in createPatchedFetcher in packages/next/src/server/lib/patch-fetch.ts. An attacker can leak a cached response body from one request to another by sending...

Important: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixes: JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance XBM...

EUVD-2026-46185

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump short mode used by rpcinfo -s, version numbers from a remote RPCBPROCDUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs rpcinfo -s against a malicious or...

CLEANSTART-2026-NE94194 Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2026-42198, CVE-2026-42577, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560, CVE-2026-5588, CVE-2026-5598, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-98qh-xjc8-98pq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cc37-9q2j-3hfv, ghsa-h2qv-fj59-j46j, ghsa-hvcg-qmg6-jm4c, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-rc95-pcm8-65v9, ghsa-v8h7-rr48-vmmv, ghsa-w573-9ffj-6ff9, ghsa-w9fj-cfpg-grvv, ghsa-wg6q-6289-32hp, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 26.5.6-r3, 26.6.1-r1, 26.6.3-r2

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EH47852 Security fixes for CVE-2026-34180, CVE-2026-48155, CVE-2026-48156, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, CVE-2026-48710, CVE-2026-48735, CVE-2026-48817, CVE-2026-48818, CVE-2026-49460, CVE-2026-49461, CVE-2026-53537, CVE-2026-53538, CVE-2026-53539, CVE-2026-53540, CVE-2026-54282, CVE-2026-54283, CVE-2026-54530, CVE-2026-54531, CVE-2026-54651, CVE-2026-57204, CVE-2026-59935, CVE-2026-59936, CVE-2026-59937, CVE-2026-59938, ghsa-537c-gmf6-5ccf, ghsa-jm82-fx9c-mx94 applied in versions: 1.85.1-r0, 1.89.5-r0, 1.90.2-r0

Multiple security vulnerabilities affect the litellm-database package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-47255

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...

EUVD-2026-45899

A vulnerability was found in the network packet de-fragmentation engine of kronosnet Version affected = 1.34. The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets...

CVE-2026-15813

A vulnerability was found in the network packet de-fragmentation engine of kronosnet Version affected = 1.34. The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets...

EUVD-2026-45731

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-63834

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

CVE-2026-63834

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

CVE-2026-63834

The CVE concerns the Linux kernel’s batman-adv tp_meter: unacked_list can be pressured to grow (via crafted small messages, seqno gaps) if the list is unbounded. The result is potential out-of-memory or high CPU usage from scanning a large unacked_list. If a limit is applied, the implementation m...

CVE-2026-63834 batman-adv: tp_meter: restrict number of unacked list entries

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

Fedora 44 : mbedtls (2026-8d954936a5)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8d954936a5 advisory. - Update to 3.6.7 - Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583,...

kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine x86 shadow paging mechanism. This use-after-free vulnerability arises from incorrect handling of Guest Frame Numbers GFNs when guest page tables are modified. A local attacker with control over a guest virtual machine could...

Oracle Linux 10 : golang-github-openprinting-ipp-usb (ELSA-2026-35832)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-35832 advisory. - rebuilt with golang-1.26.4-1.el102 to fix CVE-2026-33811, CVE-2026-27145 - rebuilt with golang-1.26.3-4.el102 to fix CVE-2026-32281 Tenable has...

[SECURITY] [DLA 4687-1] chromium security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4687-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 16, 2026 https://wiki.debian.org/LTS -...

Debian dsa-6390 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6390 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6390-1 [email protected] https://www.debian.org/securit...