CVE-2026-98411

A flaw was found in the Linux kernel's power sequencing subsystem. When device registration encounters a naming failure, the error-handling path attempts to clean up data structures before they are initialized. This issue leads to an invalid pointer dereference, which can cause the kernel to cras...

CVE-2026-106030

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe...

CVE-2026-98406

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can trigger a denial of service DoS condition by issuing a wireless bitrate configuration request while a network interface is undergoing initialization or teardown. Because the subsystem fails to verify that the...

CVE-2026-100826

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Storage: StorageManager component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securit...

CVE-2026-98410

A flaw was found in the Linux kernel's DA9063 watchdog driver. When a system suspends while the hardware watchdog timer is running without active user-space management, the driver fails to disable the timer. Consequently, the timer continues to run and can expire while the system is suspended,...

CVE-2026-98409

A flaw was found in the Linux kernel's Realtek RTD119X watchdog driver. During device initialization, the driver fails to verify that the clock rate is valid before performing timeout calculations. A local user capable of triggering device probing under misconfigured clock conditions can cause a...

CVE-2026-98408

A flaw was found in the Linux kernel's Renesas RZ/V2H watchdog timer driver. The driver fails to validate that the clock rate is non-zero during device initialization, leading to a division by zero condition. Under specific hardware or configuration states where the clock rate is zero, this issue...

CVE-2026-98405

A flaw was found in the Linux kernel's SMB Server Message Block client. When parsing POSIX security identifiers in server responses, the client fails to properly validate the server-supplied buffer length against the actual received message boundaries. A malicious or compromised SMB server could...

CVE-2026-111129

A flaw was found in assimp. An attacker can exploit this flaw by convincing a user or automated system to process a specially crafted 3D mesh file containing invalid animation track targets. Parsing this file triggers an unhandled memory access error null pointer dereference in the Ogre mesh...

CVE-2026-111128

A flaw was found in Assimp. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the host application. The issue occurs within the Ogre3D importer, which fails to properly validate bone indices when parsing 3D model files. By supplying a specially crafted mesh or...

CVE-2026-106030 Missing Authorization in NordVPN for Windows

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe...

EUVD-2026-102833

NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe...

CVE-2026-106030

The NordVPN for Windows user-mode application contains a missing authorization vulnerability where a low-privileged local attacker can connect to the named pipe \.\pipe\nord-security\v1\NordVpnService\Server. By acting as a trusted process, an attacker can invoke the ISettingsGrpc.StopService and...

CVE-2026-100812

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Graphics component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

CVE-2026-100807

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Service Workers component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100795

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Networking component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...

[SECURITY] [DLA 4838-1] chromium security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4838-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 16, 2026 https://wiki.debian.org/LTS -...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-86420: Denial of Service due to memory budget exhaustion bsc1279696. CVE-2026-86421: Denial of Service via memory leak in MSL decoder bsc1279711. CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetList meth...

SUSE-SU-2026:4691-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-86420: Denial of Service due to memory budget exhaustion bsc1279696. - CVE-2026-86421: Denial of Service via memory leak in MSL decoder bsc1279711. - CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetLis...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...