CLSA-2026-1789366696 TuxCare security update for org.apache.commons:commons-configuration2 (2 CVEs)

TuxCare rebuilt org.apache.commons:commons-configuration2 to address 2 CVEs. Fixed in 2.8.0-tuxcare.1...

PT-2026-91205

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

Adversarial Testing of Automated Program Repair Agents for Security Vulnerabilities

Software agents with Large Language Models LLMs are designed for Automated Program Repair APR tasks, raising the possibility that, in the near future, APR agents will fix bugs automatically without much human intervention. Can we trust an APR agent to produce both functionally correct and secure...

Linux Distros Unpatched Vulnerability : CVE-2026-90681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This...

Important: kernel-livepatch-6.1.177-224.371

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.1.177-224.371 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.36-69.134

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.18.36-69.134 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Chamilo Command Injection

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. id: CVE-2023-34960 info: name: Chamilo Command Injection author: DhiyaneshDK severity: critical...

EUVD-2026-76917

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery...

CVE-2026-90486

A server-side request forgery (SSRF) vulnerability exists in openstatusHQ openstatus , specifically in the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The affected functionality is not further detailed in the provided documents. The vulnerability allows a remote attacker...

CVE-2026-90486 openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery...

SUSE-SU-2026:23679-1 Security update for the Linux Kernel RT (Live Patch 4 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. - CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in us...

Linux Distros Unpatched Vulnerability : CVE-2026-89516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: schedext: Don't BUGON a destroyed DSQ in processdeferredreenqusers scxbpfdsqreenq queues a...

PT-2026-90724

Name of the Vulnerable Software and Affected Versions openstatusHQ openstatus versions up to f04c827112f30a11d571ebdad3892826034d6265 Description A remote attacker can exploit a flaw in the apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts file to perform server-side request forgery...

Linux Distros Unpatched Vulnerability : CVE-2026-80954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However,...

Linux Distros Unpatched Vulnerability : CVE-2026-80960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm-pcache: validate on-media segnum against the cache device size segnum is read from the crc32c-only superblock, so whoever supplies the cache device on a tabl...

Linux Distros Unpatched Vulnerability : CVE-2026-89757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/mglru: fix and remove redundant unevictable folio handling sortfolio has a shortcut for moving folios that are no longer evictable but are still sitting on a...

Linux Distros Unpatched Vulnerability : CVE-2026-89570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-fre...

Linux Distros Unpatched Vulnerability : CVE-2026-80969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It'...

Linux Distros Unpatched Vulnerability : CVE-2026-89601

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext2: Fix lost inode updates for ISSYNC inodes ext2setsize and ext2xattrset2 had a construct like: if ISSYNCinode syncinodemetadatainode, 1 %NASLMINLEVEL 80900...

Linux Distros Unpatched Vulnerability : CVE-2026-80973

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bou...