CVE-2026-2817

A flaw was found in Spring Data Geode. A local user with basic privileges on a shared host can exploit an insecure directory used during snapshot import. This vulnerability allows the system to extract archives into predictable and permissive temporary directories, enabling the local user to acce...

CVE-2026-26203

A flaw was found in PJSIP, a free and open-source multimedia communication library. An attacker could exploit a heap buffer underflow vulnerability by sending specially crafted, malformed H.264 bitstreams without NAL unit start codes. This unchecked pointer arithmetic can cause the packetizer to...

CVE-2026-26200

A flaw was found in HDF5, a software for managing data. An attacker who can control an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow. This can lead to a denial-of-service condition, and could potentially lead to further issues such as remote code execution, though its...

CVE-2025-69725

A flaw was found in go-chi/chi, a Go programming language HTTP router. This open redirect vulnerability, specifically within the RedirectSlashes function, allows a remote attacker to redirect users to malicious websites. This occurs by manipulating the legitimate website's domain, potentially...

CVE-2026-24834

A flaw was found in Kata Containers. A user of a container can exploit this vulnerability by modifying the file system used by the Guest micro Virtual Machine VM. This allows the attacker to achieve arbitrary code execution as root within the compromised Guest VM. This issue does not impact the...

CVE-2026-26278

A denial of service flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted, small XML input. This input can force the XML parser to perform an unlimited amount of entity expansion, consuming excessive resources. This can lead to the...

CVE-2026-2648

A heap buffer overflow flaw was found in the PDFium component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=477033835...

CVE-2025-71230

In the Linux kernel, the following vulnerability has been resolved: hfs: ensure sb-sfsinfo is always cleaned up When hfs was converted to the new mount api a bug was introduced by changing the allocation pattern of sb-sfsinfo. If setupbdevsuper fails after a new superblock has been allocated by...

CVE-2025-71236

A flaw was found in the Linux kernel's qla2xxx driver. This vulnerability, a NULL pointer dereference, occurs during fabric asynchronous scan cleanup when the qlafabasyncscan function attempts to free memory associated with a NULL pointer. A local user may be able to indirectly trigger this flaw...

CVE-2026-2733

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

Linux Distros Unpatched Vulnerability : CVE-2025-61982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. A specially crafted OpenFOAM simulation fi...

Linux Distros Unpatched Vulnerability : CVE-2026-27473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.9 allows Stored Cross-Site Scripting XSS via syndicated sites in the private area. The URLSYNDIC output is not properly sanitized on the private...

DSA-6143-1 libvpx - security update

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2025-69725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using th...

Linux Distros Unpatched Vulnerability : CVE-2025-71242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when...

CVE-2025-14009

A code execution vector has been discovered in the python NTLK library. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, ca...

CVE-2026-25500

A cross site scripting vulnerability has been discovered in the rubygem Rack. Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the javascript: scheme e.g. javascript:alert1, the generated...

CVE-2025-66614

A certificate validation flaw has been found in Apache Tomcat. omcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one ...

MINI-P7F5-JCMX-58X3

Bulletin has no description...

CVE-2026-23230

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability is caused by a race condition during concurrent updates to internal flags, which can lead to stale data being restored. A remote attacker with low privileges could exploit this, potentially causing unexpect...