CVE-2026-39894

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtoolfunctionupdate can corrupt RRDtool metric values. The rrdtoolfunctionupdate function checks metric values with isnumeric and concatenates them into t...

GHSA-38CX-CQ6F-5755 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

GHSA-5R4X-W6P5-222Q vulnerabilities

Vulnerabilities for packages: imagemagick...

GHSA-R75F-5X8P-QVMC vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-WPFP-GWWC-VWQ6 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-53104

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix memory leak destroying device All MT76 rx queues have an associated pagepool even if the queue is not associated to a NAPI e.g. WED RRO queues with WED enabled. Destroy the pagepool running mt76dmacleanup routine...

GHSA-2388-JP8V-FG9W vulnerabilities

Vulnerabilities for packages: nginx-stable, ingress-nginx-controller, nginx-mainline...

CVE-2026-52943

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskbcarve helpers pskbcarveinsideheader and pskbcarveinsidenonlinear both copy the old skbsharedinfo header into a new buffer via memcpy, which includes the destructorarg pointer uar...

CVE-2026-52924

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctpstreamupdate is only invoked when the association is moved into COOKIEWAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state...

CVE-2026-9539

An out-of-bounds heap read and integer underflow in the TCP urgent data handling sosendoob in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments e.g., QEMU allows a privileged guest VM attacker root or CAPNETRAW to leak gigabytes of sensitive host-process heap memory v...

CVE-2026-34180 affecting package openssl for versions less than 3.3.7-3

CVE-2026-34180 affecting package openssl for versions less than 3.3.7-3. A patched version of the package is available...

ROS-20260624-73-0048

The vulnerability in python-aiohttp is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

frr10 security update

10.4.3-3 - Resolves: RHEL-174696 - denial of service via crafted BGP UPDATE message 10.4.3-2 - Resolves: RHEL-174678 - denial of service via crafted FlowSpec component...

ROS-20260624-73-0004

The vulnerability in gpac is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260624-73-0003

The vulnerability in gpac is related to the execution of operations outside the buffer in memory. The vulnerability can be exploited remotely...

CVE-2025-61029

An issue in the sqlountry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

CVE-2025-61024

An issue in the sqlotryinloop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

CVE-2026-56117

dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/control.c that allows local unprivileged attackers to trigger memory corruption when privilege separation is disabled. Attackers can connect to the control socket...

GHSA-M25M-5778-FM22 vulnerabilities

Vulnerabilities for packages: grafana-fips...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling...