PT-2026-69545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the iomap subsystem when handling zero-length ranges. The functions ifs set range dirty and ifs set range uptodate calculate the last blk value using a...

PT-2026-69549

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtual file system VFS helper forget cached acl where it fails to preserve the ACL DONT CACHE state. This state is intended to be constant for inodes in filesyste...

[SECURITY] [DLA 4725-1] bind9 security update

Debian LTS Advisory DLA-4725-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias August 08, 2026 https://wiki.debian.org/LTS Package : bind9 Version : 1:9.16.50-1deb11u6 1:9.18.49-1deb12u2 CVE ID : CVE-2026-3039 CVE-2026-3592 CVE-2026-5946 CVE-2026-5950 CVE-2026-1072...

EulerOS 2.0 SP11 : util-linux (EulerOS-SA-2026-3108)

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check- Time-of-Use vulnerability has been...

EulerOS 2.0 SP11 : expat (EulerOS-SA-2026-3065)

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer dereference with...

libpng12 security update

1.2.50-10.0.3 - Fix CVE-2026-33416: use-after-free via pointer aliasing in pngsettRNS and pngsetPLTE Orabug: 39771480 1.2.50-10.0.1 - Fix CVE-2026-25646: heap buffer overflow in pngsetquantize Orabug: 39183864...

MGASA-2026-0324 Updated python-django packages fix security vulnerabilities

The updated package fixes security vulnerabilities: Signed cookie salt namespace collision in django.http.HttpRequest.getsignedcookie. CVE-2026-6873 Potential unencrypted email transmission via STARTTLS in the SMTP backend. CVE-2026-7666 Potential exposure of private data via case-sensitive...

OESA-2026-3244 sg3_utils security update

The sg3utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI e.g. Fibre Channel FCP, Serial Attached SCSI SAS and the SCSI Parallel InterfaceSPI many other devices use SCSI command sets. ATAPI cd/dvd drives and SAT...

SUSE CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

The vulnerability of the dwcmshc_rk3568_set_clock() function in the drivers/mmc/host/sdhci-of-dwcmshc.c driver for MMC/SD/SDIO cards in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the dwcmshcrk3568setclock function in the drivers/mmc/host/sdhci-of-dwcmshc.c driver for MMC/SD/SDIO cards in the Linux operating system is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the functions set_secret() and ceph_crypto_key_decode() in the net/ceph/crypto.c module of the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the functions setsecret and cephcryptokeydecode in the net/ceph/crypto.c module of the Linux kernel is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow a remote attacker t...

EulerOS 2.0 SP13 : sudo (EulerOS-SA-2026-3002)

According to the versions of the sudo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not...

GHSA-R4W5-6PFG-JXP5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...

GHSA-9PF5-HG6P-4PWP Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Impact For serial-port and media camera / microphone permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe...

Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

EUVD-2026-53359

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

EUVD-2026-53358

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click...

MAL-2026-12434 Malicious code in saas-f-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4a492a289f0cc0ec0f924149b0cd29521c60747d6fe700d84d03ddddcd8a65 On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames oob-worker.cf103-07.0.workers.dev...