UBUNTU-CVE-2026-53402

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in errout of fbcondosetfont When fbcondosetfont fails e.g., due to a memory allocation failure inside vcresize under heavy memory pressure, it jumps to the errout label to roll back the consol...

CVE-2026-63829 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...

CVE-2026-16224 jxxghp MoviePilot Application API improper authorization

A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The identifier of the pat...

ROOT-OS-UBUNTU-2404-CVE-2025-38676 CVE-2025-38676 in rootio-linux - Patched by Root

Root has patched CVE-2025-38676 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-16198

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...

EUVD-2026-44939

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader...

GHSA-F7WF-V2VW-MPCX mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

Impact contextimport passed the caller-supplied filePath directly to fs.readFileSync with no path confinement. A malicious MCP client — or an LLM agent that is prompt-injected into calling the tool — could point filePath at any file readable by the server process, outside any session or export...

CVE-2026-16008

A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDependencies.ts. The manipulation leads to improperly controlled modification of object prototype attributes. The attack can...

SUSE-SU-2026:22915-1 Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-32.1 fixes various security issues: The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

SUSE-SU-2026:22792-1 Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-33.1 fixes various security issues: The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

Dell Client BIOS Authentication Bypass (DSA-2026-195)

Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure. Note that Nessus has not tested for this issue but has instead relied on...

ROOT-OS-DEBIAN-11-CVE-2026-5435 CVE-2026-5435 in rootio-glibc - Patched by Root

Root has patched CVE-2026-5435 in the rootio-glibc package for Root:Debian:11. Multiple fixed versions available...

SUSE-SU-2026:22678-1 Security update for the Linux Kernel (Live Patch 21 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-44.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094....

ROOT-APP-NPM-CVE-2021-23337 CVE-2021-23337 in @rootio/lodash.template - Patched by Root

Root has patched CVE-2021-23337 in the @rootio/lodash.template package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-21681 CVE-2022-21681 in @rootio/marked - Patched by Root

Root has patched CVE-2022-21681 in the @rootio/marked package for Root:npm. Multiple fixed versions available...

Security update for python-urllib3

This update for python-urllib3 fixes the following issue Regression introduced by CVE-2025-66471 fix during file download with pySSL bsc1270365. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively yo...

giflib security update

5.2.1-25 - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension RHEL-157086 5.2.1-24 - rebuild 5.2.1-23 - fix CVE-2026-23868: double free in GifMakeSavedImage RHEL-154850...

GHSA-Q78P-HJ9H-5466 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

CVE-2026-45337

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny...

ROOT-APP-MAVEN-CVE-2026-50560 CVE-2026-50560 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-50560 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...