CVE-2026-33603

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and...

GHSA-V3XG-VJWM-WV2Q vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-41492 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-31702 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-31702 affecting package kernel for versions less than 6.6.137.1-2. An upgraded version of the package is available that resolves this issue...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: cert-manager, kube-fluentd-operator, kubeflow, step, conjur-cli, container-object-storage-interface, nri-apache, secrets-store-csi-driver, aws-flb-firehose, k8ssandra-client, octo-sts, kubernetes-csi-external-attacher, flux, apko, datadog-agent, influx, incert,...

CVE-2026-43359

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the BTRFSUUIDKEYRECEIVEDSUBVOL we have to abort the transaction since we did...

CVE-2026-43344

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up bugs In snbeppci2phymapinit, in the nrnodeids 8 path, uncoredevicetodie may return -1 when all CPUs associated with the UBOX device are offline. Remove the WARNONONCEdieid == -1...

CVE-2026-44312 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

exim: Fix of CVE-2026-40685

CVE-2026-40685: fix OOB heap write in dewrap during JSON expansion...

GHSA-JP4C-XJXW-MGF9 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, pypy-3.10, py3.14-virtualenv, datadog-agent, py3-cassandra-medusa, py3-pip, py3-virtualenv...

CVE-2026-43196

In the Linux kernel, the following vulnerability has been resolved: soc: ti: pruss: Fix double free in prussclkmuxsetup In the prussclkmuxsetup, the devmaddactionorreset indirectly calls prussoffreeclkprovider, which calls ofnodeputclkmuxnp on the error path. However, after the devmaddactionorres...

CVE-2026-43133

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f "KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state" made KVM always use vmcb01 for the fields controlled by VMSAVE/VMLOAD, but it missed...

ROS-20260505-73-0014

A vulnerability in the http.cookies library of the Python programming language interpreter CPython is related to improper encoding or escaping of output data. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality and integrity of protected information...

firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions, integer overflow in the Graphics: Text component...

CVE-2026-43030

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsafe for pointers to packet In case rold-reg-range == BEYONDPKTEND && rcur-reg-range == N regsafe may return true which may lead to current state with valid packet range not being explored. Fix the bug...

GHSA-QHMP-Q7XH-99RH vulnerabilities

Vulnerabilities for packages: k8sgateway, kubernetes-dns-node-cache, juicefs...

GHSA-63CW-R7XF-JMWR vulnerabilities

Vulnerabilities for packages: k8sgateway, kubernetes-dns-node-cache, juicefs...

freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

A null pointer dereference has been discovered in FreeRDP. A NULL pointer dereference vulnerability in rdpwritelogoninfov2 allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0...

[SECURITY] Fedora 44 Update: composer-2.9.7-1.fc44

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

CVE-2026-42036

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This...