CVE-2026-53387

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

CVE-2026-53391

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length raddr in nfs4decodempdsaddr nfs4decodempdsaddr decodes the rnetid and raddr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchrbuf, '.' to locate the port...

CVE-2026-53393

In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors nfsdvfswrite and nfsdcommit both call filemapcheckwberr to detect deferred writeback errors, but neither rotates the server's write verifier nn-writeverf when this check...

CVE-2026-53399

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into cl-clstateids via idralloccyclic under cllock before returning to nfsd4alloclayoutstateid. When nfsd4layoutsetlease then fails, the error pat...

CVE-2026-53403

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fbnewmodelist to prevent null-ptr-deref in fbvideomodetovar info-var, a framebuffer's current mode, is expected to have a matching entry in info-modelist. vartodisplay relies on this and treats a failed fbmatchmode as...

UBUNTU-CVE-2026-63827

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aareplaceprofiles walks ns-rawdatalist to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aaloaddata, list...

CVE-2026-46404

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23...

UBUNTU-CVE-2026-53366

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In ipappenddata, when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;...

CVE-2026-53366

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In ipappenddata, when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;...

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

PT-2026-57996

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description An issue exists where an HTTP URI containing a semicolon, such as /public;/../admin/secret.txt, results in an unresolved path of /public/../admin/secret.txt instead of the expected...

Use of Incorrectly-Resolved Name or Reference

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference through the resourcename function in permissions.py and the mirrored core permissions modul...

CLEANSTART-2026-RJ71322 Security fixes for CVE-2026-27145, CVE-2026-32952, CVE-2026-33814, CVE-2026-39821, CVE-2026-39824, CVE-2026-39833, CVE-2026-41602, CVE-2026-42499, CVE-2026-42504, CVE-2026-42507, CVE-2026-42508, CVE-2026-46595 applied in versions: 0.20260330.001845-r0, 0.20260330.001845-r1

Multiple security vulnerabilities affect the minio package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UZ41796 Security fixes for CVE-2026-42304, CVE-2026-44307, CVE-2026-48522, CVE-2026-48523, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, ghsa-2h4p-vjrc-8xpq, ghsa-grgv-6hw6-v9g4 applied in versions: 4.3.5-r0, 4.3.5-r1

Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PX93187 Security fixes for CVE-2025-13151, CVE-2026-22695, CVE-2026-22801, CVE-2026-2332, CVE-2026-24515, CVE-2026-25210, CVE-2026-25646, ghsa-72hv-8253-57qq applied in versions: 3.7.2-r4, 3.7.2-r5, 3.7.2-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-14278

After further coordination, CVE was determined to not be warranted...

CLEANSTART-2026-YE67255 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33186, CVE-2026-33810, CVE-2026-39883, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 1.28.1-r0, 1.28.1-r1, 1.28.1-r2

Multiple security vulnerabilities affect the cass-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KB52131 Security fixes for CVE-2025-13151, CVE-2026-22695, CVE-2026-22801, CVE-2026-24515, CVE-2026-25210, CVE-2026-25646, CVE-2026-42583, ghsa-72hv-8253-57qq, ghsa-mj4r-2hfc-f8p6, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r5, 3.9.4-r6, 3.9.5-r0, 3.9.5-r1

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...