Linux Distros Unpatched Vulnerability : CVE-2026-90949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a...

CVE-2026-25832

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...

Linux Distros Unpatched Vulnerability : CVE-2026-89519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schedext: Replace SCXRQBALKEEP with a dispatch verdict return SCXRQBALKEEP tells the pick to keep running the previous task, a leftover from when balancing and...

CVE-2026-89521

A flaw was found in the Linux kernel's core scheduling component. This issue occurs when the picktask function releases the run queue rq lock, allowing an interleaving selection to invalidate the scheduler's internal state. This inconsistency can lead to incorrect task selection and skewed resour...

DEBIAN-CVE-2026-89520

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

DEBIAN-CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

UBUNTU-CVE-2026-89520

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

CVE-2026-89521

CVE-2026-89521 affects the Linux kernel's core scheduling subsystem. When a ->pick_task() implementation releases the run queue (rq) lock, the selection state derived in pick_next_task() becomes invalid, allowing an interleaving selection to commit an incorrect (uncookied) pick or skew forceid...

UBUNTU-CVE-2026-78807

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

PT-2026-90237

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in core scheduling where the pick next task function fails when a pick task implementation releases the rq lock. The selection state established at the start is only vali...

CVE-2026-41871

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. I...

EUVD-2026-63095

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext...

PT-2026-86649

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-85038

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin for WordPress (versions before 5.2.40 ) is vulnerable to an unauthenticated B2B group assignment and approval bypass . The root cause is a failure to verify that a role selected during registration matches the options actually offered on...

ROS-20260902-73-0022

The vulnerability in perl-DBI relates to the use of external control for selecting classes based on input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-81523

A flaw was found in libmongocrypt. A missing input validation vulnerability in the automatic-encryption context setup allows a caller-supplied database identifier to be accepted without proper sanitization. This can lead to incorrect schema selection, potentially resulting in limited disclosure o...

K000163143: Multiple CoreDNS vulnerabilities CVE-2026-35579, CVE-2026-33489, CVE-2026-33190, CVE-2026-32934, CVE-2026-32936

Security Advisory Description CVE-2026-35579 CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configurati...

CVE-2026-82726

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

EUVD-2026-68335

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...