net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

Security Bulletin:Vulnerability in LibXML affects IBM Netezza Appliance

Summary The LibXML package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-8177 Vulnerability Details CVEID:CVE-2026-8177 DESCRIPTION: XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containi...

Security Bulletin:Vulnerability in Kerberos 5 affects IBM Netezza Appliance

Summary The Kerberos 5 package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-40355 Vulnerability Details CVEID:CVE-2026-40355 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls...

CVE-2026-68090

A flaw was found in the debugobjects component of the Linux kernel. A race condition can occur when an out-of-memory OOM situation happens concurrently with certain debug object operations. This can lead to a dysfunctional timer and a kernel warning, potentially causing system instability or a...

CVE-2026-68225

A flaw was found in the Linux kernel's media I2C Alvium driver. The alviumctrlinit function, responsible for initializing controls, does not properly check if pointers are valid before using them. This can lead to the system attempting to write data to an invalid memory location, which could allo...

CVE-2026-68085

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. This vulnerability occurs when a Bluetooth device is reopened after a pending write operation was canceled, but an internal flag indicating a pending write is no...

CVE-2026-68245

A flaw was found in the drm/amdgpu component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine VM pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker...

CVE-2026-68084

A flaw was found in the Linux kernel's tsi148 bridge component. This vulnerability occurs due to a resource leak where the location monitor resources are not properly freed during device unbind or module unload operations. An attacker could potentially exploit this flaw to exhaust system resource...

CVE-2026-68266

A flaw was found in the drm/xe component of the Linux kernel. This vulnerability, a use-after-free, occurs because a dma-buf Direct Memory Access Buffer reference is not properly held for imported Buffer Objects BOs. If the exporter of a dma-buf is freed while a BO still references its reservatio...

CVE-2026-72610 Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers = editborrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a...

CVE-2026-72610

Koha CVE-2026-72610 is a stored SQL injection affecting Koha releases up to 26.05.01 where an authenticated staff member with the borrowers => edit_borrowers permission can store a SQL payload in a patron lang field. The payload concatenates into a subquery in Koha::AdditionalContents->sear...

Security Bulletin:Vulnerability in binutils affects IBM Netezza Appliance

Summary The binutils package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-4647 Vulnerability Details CVEID:CVE-2026-4647 DESCRIPTION: A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as...

Important: Red Hat Security Advisory: fence-agents security update

An update for fence-agents is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

CVE-2026-68109

A flaw was found in the Linux kernel, specifically within the drm/amdgpu/sdma7.1 component. This vulnerability occurs when a BUGON macro is triggered, which can lead to an immediate kernel crash. An attacker could potentially exploit this to cause a Denial of Service DoS on the affected system...

CVE-2026-68265

A flaw was found in the Linux kernel. Specifically, within the drm/xe/vm module, an out-of-bounds access can occur when handling the DRMXECONSULTMEMADVISEPREFLOC region for a Buffer Object BO Virtual Memory Area VMA. This happens because a value of -1 is incorrectly used as an index into a memory...

CVE-2026-68311

A flaw was found in the Linux kernel's wifi: mt76: mt7925 driver. When handling Multi-Link Operation MLO stations, the mt7925stasetdecapoffload function can attempt to dereference a null pointer if a station link is not properly associated with a Virtual Interface VIF link. This can lead to a...

CVE-2026-68096

A flaw was found in the Linux kernel's audit subsystem. A local user can trigger a recursive locking deadlock by moving a file that has an existing executable audit rule. This occurs when the audit subsystem attempts to acquire a lock that is already held, leading to a system-wide deadlock. This...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...