DEBIAN-CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

EUVD-2026-97652

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109350 Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

org.apache.nifi:nifi-snowflake-processors (>=2.10.0, <=2.11.0), org.apache.nifi:nifi-snowflake-processors-nar (>=2.10.0, <=2.11.0) +4 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (>=4.3.0, <=4.3.2)

net.snowflake:snowflake-jdbc-thin MAVEN version =4.3.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.11.0 Source cves: CVE-2026-86597 Source advisory: OSV:GHSA-QQJ6-54Q6-CXV6...

org.apache.nifi:nifi-snowflake-processors (2.8.0), org.apache.nifi:nifi-snowflake-processors-nar (2.8.0) +5 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.28.0)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - org.apache.nifi:nifi-snowflake-processors 2.8.0 -...

org.apache.nifi:nifi-snowflake-processors (>=2.7.0, <=2.7.2), org.apache.nifi:nifi-snowflake-processors-nar (>=2.7.0, <=2.7.2) +4 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.27.1)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - org.apache.nifi:nifi-snowflake-processors =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0,...

io.github.zoom-dustin-moriarty:zoom-data-fence (1.0.0), net.snowflake:snowflake-ingest-sdk (>=4.0.1-unshaded, <=4.1.0-unshaded) +1 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.24.2)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.24.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - io.github.zoom-dustin-moriarty:zoom-data-fence 1.0.0 - net.snowflake:snowflake-ingest-sdk...

org.apache.nifi:nifi-snowflake-processors (>=2.10.0, <=2.11.0), org.apache.nifi:nifi-snowflake-processors-nar (>=2.10.0, <=2.11.0) +4 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (>=4.3.0, <=4.3.2)

net.snowflake:snowflake-jdbc-thin MAVEN version =4.3.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.10.0, =2.11.0 Source cves: CVE-2026-86597 Source advisory: GHSA-QQJ6-54Q6-CXV6...

net.snowflake:snowflake-ingest-sdk (>=3.1.2-beta.unshaded, <=4.0.0-unshaded) potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.22.0)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - net.snowflake:snowflake-ingest-sdk =3.1.2-beta.unshaded, =4.0.0-unshaded Source cves:...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm thin: Make getfirstthin use listfirstornullrcu instead of rcu-safe list first function. The documentation in rculist.h explains the absence of listemptyrcu and warns programmers against relying on a sequence of listempty -...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm thin: Fixed a UAF in runtimersoftirq When dmresume and dmdestroy are executed concurrently, it will lead to a UAF, as follows: Bug: KASAN: Use-after-free in runtimers+0x173/0x710 A 8-byte value is written to the address...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm thin: Use the pmd-root from the last transaction when commit fails. Recently, we discovered a problem with a softlockup in the dm thin pool’s btree lookup code due to corrupted metadata. Kernel panic – not syncing: Softlockup:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: dm thin: Fixed a use-after-free crash in dmsmregisterthresholdcallback. Reports of faults injecting into the pool metadata device: - BUG: KASAN: Use-after-free in dmpoolregistermetadatathreshold+0x40/0x80. - Reading of size 8 ...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around the sysctltcpthinlineartimeouts function. When reading sysctltcpthinlineartimeouts, it can be changed concurrently. Therefore, we need to add READONCE to its reader...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: dmbtreeremove: Assign newroot only when the removal succeeds. The removeraw function in dmbtreeremove may fail due to IO read errors e.g., failure to read the content of the origin block during shadowing. Additionally, the value ...

Malicious Package

Overview mms-thin-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data

A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday. The data came from disk space that earlier containers had used and given up, not from any live workloa...

EUVD-2026-75566

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

SUSE CVE-2026-72108

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in the blockmanager's buffer. If the subsequent metadata commit fails, th...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104554)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104554 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and...