EUVD-2026-39209

In the Linux kernel, the following vulnerability has been resolved: wifi: fix leak if split 6 GHz scanning fails rdev-intscanreq is leaked if cfg80211scan fails. Note that it's supposed to be released at cfg80211scandone but this doesn't happen as rdev-scanreq is NULL at that point, too, leading ...

CVE-2026-53258

In the Linux kernel, the following vulnerability has been resolved: wifi: fix leak if split 6 GHz scanning fails rdev-intscanreq is leaked if cfg80211scan fails. Note that it's supposed to be released at cfg80211scandone but this doesn't happen as rdev-scanreq is NULL at that point, too, leading ...

CVE-2026-53253

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before...

CVE-2026-53253

CVE-2026-53253 affects the Linux kernel Bluetooth BNEP stack. The vulnerability arises when a BNEP peer sends a short SDU and the kernel bnep_rx_frame() reads the packet type, then bnep_rx_control() dereferences the control opcode or setup UUID-size byte before ensuring those bytes are present. T...

CVE-2026-53253 Bluetooth: bnep: reject short frames before parsing

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before...

EUVD-2026-39204

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before...

EUVD-2026-39317

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: fix generic IRQ chip leak on remove The driver allocates domain generic chips using irqallocdomaingenericchips during probe. However, on driver remove/teardown, the generic chips are not automatically freed when t...

EUVD-2026-39309

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftexthdr: fix register tracking for FPRESENT flag nftexthdrinit passes user-controlled priv-len to nftparseregisterstore, which marks that many bytes in the register bitmap as initialized. However, when...

CVE-2026-53208 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2capcore.c:l2capsigchannel accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU MTUsig...

EUVD-2026-39238

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer...

SUSE-SU-2026:2626-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments directly to urllib.request.urlopen and allows for SSRF and token forgery bsc1266798. - CVE-2026-48523: verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are...

CVE-2026-9702

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-12490

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port and not the tls-auth-port or over over TCP over the regular...

CVE-2026-54512 vulnerabilities

Vulnerabilities for packages: trino, kafka, ruby3.3-jrjackson, logstash-fips, jmeter, kafka-bridge, apache-nifi, spdx-tools-java, akhq, flyway-fips, zookeeper-fips, request-9047-keycloak-fips, ruby4.0-jrjackson, nextflow, cassandra-reaper, airbyte-server, gradle, jenkins-plugin-manager,...

CVE-2026-54514 vulnerabilities

Vulnerabilities for packages: trino, kafka, ruby3.3-jrjackson, logstash-fips, jmeter, kafka-bridge, apache-nifi, spdx-tools-java, akhq, flyway-fips, zookeeper-fips, request-9047-keycloak-fips, ruby4.0-jrjackson, nextflow, cassandra-reaper, airbyte-server, gradle, jenkins-plugin-manager,...

GHSA-RCQC-6CW3-H962 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, cassandra-fips, trino, nacos-docker, spark, thingsboard, kafka, ruby3.3-jrjackson, scala, logstash-fips, apache-tika, management-api-for-apache-cassandra-4.1, nacos, apache-camel-karavan-devmode, apache-activemq-fips, apache-nifi,...

CVE-2026-54513 vulnerabilities

Vulnerabilities for packages: trino, kafka, ruby3.3-jrjackson, logstash-fips, jmeter, kafka-bridge, apache-nifi, spdx-tools-java, akhq, flyway-fips, zookeeper-fips, request-9047-keycloak-fips, ruby4.0-jrjackson, nextflow, cassandra-reaper, airbyte-server, gradle, jenkins-plugin-manager,...

CVE-2026-54516 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, cassandra-fips, trino, nacos-docker, spark, thingsboard, kafka, ruby3.3-jrjackson, scala, logstash-fips, apache-tika, management-api-for-apache-cassandra-4.1, nacos, apache-camel-karavan-devmode, apache-activemq-fips, apache-nifi,...

CVE-2026-54517 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, cassandra-fips, trino, nacos-docker, spark, thingsboard, kafka, ruby3.3-jrjackson, scala, logstash-fips, apache-tika, management-api-for-apache-cassandra-4.1, nacos, apache-camel-karavan-devmode, apache-activemq-fips, apache-nifi,...

GHSA-RMJ7-2VXQ-3G9F vulnerabilities

Vulnerabilities for packages: trino, kafka, ruby3.3-jrjackson, logstash-fips, jmeter, kafka-bridge, apache-nifi, spdx-tools-java, akhq, flyway-fips, zookeeper-fips, request-9047-keycloak-fips, ruby4.0-jrjackson, nextflow, cassandra-reaper, airbyte-server, gradle, jenkins-plugin-manager,...