SUSE CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CLEANSTART-2026-WQ12431 Security fixes for CVE-2026-39822, CVE-2026-42504, CVE-2026-42505 applied in versions: 2.18.0-r5, 2.19.1-r0

Multiple security vulnerabilities affect the kube-state-metrics package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-64177

A flaw was found in the Linux kernel's Phonet Pipe End Point PEP protocol. This vulnerability arises from an inconsistent lock state when the pepdorcv function forwards a packet to a child socket. Specifically, the child socket's lock can be acquired with Bottom Halves BH enabled in one execution...

CVE-2026-64104

A flaw was found in the Linux kernel's SEV-ES Secure Encrypted Virtualization-Encrypted State guest module. When memory encryption or decryption operations fail, the affected memory pages can be left in an unknown or unencrypted state. This could lead to information disclosure, as these pages are...

CVE-2026-64152

A flaw was found in the Linux kernel's Input/Output Memory Management Unit IOMMU subsystem when iommudebug is enabled. This issue occurs because an error handling path attempts to unmap memory without a proper initial mapping, leading to an inconsistent state within the IOMMU's debugging and...

CVE-2026-64205

A flaw was found in the Linux kernel's i2c-i801 driver. This vulnerability allows a local attacker to trigger a hardware state machine corruption during error handling. This can lead to a denial of service DoS, where the system becomes unresponsive due to a continuous stream of error messages and...

PT-2026-61983

Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description A custom client with valid permissions to access the BuildKit control API can send a specially crafted upload request to the BuildKit daemon. This allows files to escape from the...

CVE-2026-52470

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

PT-2026-62087

Name of the Vulnerable Software and Affected Versions Crocus version 1.3.44 Description A SQL injection flaw allows a remote attacker to escalate privileges. This issue occurs through the RecordStateMapper.xml file. SQL injection is a technique where malicious SQL statements are inserted into ent...

PT-2026-62085

Name of the Vulnerable Software and Affected Versions exo-explore exo version 1.0.69 Description An issue allows a remote attacker to escalate privileges without authentication. This is possible through the 'GET /state' and 'DELETE /instance/instance id' endpoints, where instance id is a variable...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-50759: Missing Authentication for Critical Function

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-50759

The software exo-explore exo version 1.0.69 contains a vulnerability that allows a remote attacker to escalate privileges without authentication. This is achieved by exploiting the GET /state and DELETE /instance/{instance_id} endpoints. The DELETE endpoint treats the instance_id as a variable, e...

CVE-2026-15789: Improper Limitation of a Pathname to a Restricted Directory

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

The vulnerability of the pci_endpoint_test_msi_irq() function in the drivers/misc/pci_endpoint_test.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the pciendpointtestmsiirq function in the drivers/misc/pciendpointtest.c module of the Linux kernel is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

ALSA-2026:42919 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: Linux kernel: Denial of Service due to memory leak in tpm2loadcmd CVE-2025-71147 kernel:...

CVE-2026-44584

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...

CVE-2026-63768

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...