OESA-2026-4269 GraphicsMagick security update

GraphicsMagick is the swiss army knife of image processing. Comprised of 267K physical lines according to David A. Wheeler's SLOCCount of source code in the base package or 1,225K including 3rd party libraries it provides a robust and efficient collection of tools and libraries which support...

OESA-2026-4264 librsvg2 security update

An SVG library based on cairo. Security Fixes: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entit...

OESA-2026-4265 librsvg2 security update

An SVG library based on cairo. Security Fixes: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entit...

OESA-2026-4263 librsvg2 security update

An SVG library based on cairo. Security Fixes: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entit...

OESA-2026-4262 librsvg2 security update

An SVG library based on cairo. Security Fixes: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entit...

CVE-2026-98417

A flaw was found in the Linux kernel's XFRM IPsec encryption framework subsystem. A remote attacker could exploit this issue by sending specially crafted ESP-in-TCP Encapsulating Security Payload over Transmission Control Protocol packets with invalid transport header offsets. This improper...

CVE-2026-98414

A flaw was found in the Linux kernel. An issue in the memory control group memcg subsystem occurs when memory allocated within a child control group is transferred to the root group upon group deletion. Subsequent memory reclamation improperly charges pages to the root group without ever unchargi...

CVE-2026-98413

A flaw was found in the Linux kernel's SELinux Security-Enhanced Linux subsystem. When an access check is performed with an empty permission set, the Access Vector Cache AVC fails to initialize the access decision structure before returning. A local attacker can exploit this flaw by triggering...

CVE-2026-98416

A flaw was found in the Linux kernel's Texas Instruments K3 UDMA Unified Direct Memory Access driver. This vulnerability can lead to a Denial of Service DoS caused by a null pointer dereference when freeing resources during a failed channel request. Under resource-exhaustion conditions, the...

CVE-2026-98412

A flaw was found in the Linux kernel's power sequencing subsystem. If a memory allocation failure occurs while setting up dependencies in pwrsequnitsetupdeps, error handling cleans up the partially allocated unit without having initialized its internal list. This uninitialized state leads to a NU...

CVE-2026-98411

A flaw was found in the Linux kernel's power sequencing subsystem. When device registration encounters a naming failure, the error-handling path attempts to clean up data structures before they are initialized. This issue leads to an invalid pointer dereference, which can cause the kernel to cras...

CVE-2026-106030

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe...

CVE-2026-98406

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can trigger a denial of service DoS condition by issuing a wireless bitrate configuration request while a network interface is undergoing initialization or teardown. Because the subsystem fails to verify that the...

CVE-2026-100826

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Storage: StorageManager component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securit...

CVE-2026-98410

A flaw was found in the Linux kernel's DA9063 watchdog driver. When a system suspends while the hardware watchdog timer is running without active user-space management, the driver fails to disable the timer. Consequently, the timer continues to run and can expire while the system is suspended,...

CVE-2026-98409

A flaw was found in the Linux kernel's Realtek RTD119X watchdog driver. During device initialization, the driver fails to verify that the clock rate is valid before performing timeout calculations. A local user capable of triggering device probing under misconfigured clock conditions can cause a...

CVE-2026-98408

A flaw was found in the Linux kernel's Renesas RZ/V2H watchdog timer driver. The driver fails to validate that the clock rate is non-zero during device initialization, leading to a division by zero condition. Under specific hardware or configuration states where the clock rate is zero, this issue...

CVE-2026-98405

A flaw was found in the Linux kernel's SMB Server Message Block client. When parsing POSIX security identifiers in server responses, the client fails to properly validate the server-supplied buffer length against the actual received message boundaries. A malicious or compromised SMB server could...

CVE-2026-111129

A flaw was found in assimp. An attacker can exploit this flaw by convincing a user or automated system to process a specially crafted 3D mesh file containing invalid animation track targets. Parsing this file triggers an unhandled memory access error null pointer dereference in the Ogre mesh...

CVE-2026-111128

A flaw was found in Assimp. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the host application. The issue occurs within the Ogre3D importer, which fails to properly validate bone indices when parsing 3D model files. By supplying a specially crafted mesh or...