CVE-2026-42880 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, argocd-image-updater-fips...

GHSA-VF5J-865M-MQ7C vulnerabilities

Vulnerabilities for packages: jenkins, apache-nifi...

CVE-2026-43471

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcdaddcommandtrace The kernel log indicates a crash in ufshcdaddcommandtrace, due to a NULL pointer dereference when accessing hwq-id. This can happen if...

CVE-2026-43446

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix runtime suspend deadlock when there is pending job The runtime suspend callback drains the running job workqueue before suspending the device. If a job is still executing and calls pmruntimeresumeandget, it can...

CVE-2026-43434

In the Linux kernel, the following vulnerability has been resolved: rustbinder: check ownership before using vma When installing missing pages or zapping them, Rust Binder will look up the vma in the mm by address, and then call vminsertpage or zappagerangesingle. However, if the vma is closed an...

CVE-2026-43429

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Use usbbulkmsgkillable with user-specified timeouts The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usbbulkmsg calls. Since the user can specify...

CVE-2026-43428

In the Linux kernel, the following vulnerability has been resolved: USB: core: Limit the length of unkillable synchronous timeouts The usbcontrolmsg, usbbulkmsg, and usbinterruptmsg APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the...

CVE-2026-43424

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: Fix NULL pointer dereferences in nexus handling The tpg-tpgnexus pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends...

CVE-2026-43365

In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized liclogroundoff values If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k...

CVE-2026-43362

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2write SMB2write places write payload in iov1..n as part of rqiov. smb3inittransformrq pointer-shares rqiov, so cryptmessage encrypts iov1 in-place, replacing the original...

CVE-2026-42561 vulnerabilities

Vulnerabilities for packages: reflex, semgrep, airflow...

CVE-2026-22740 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, thingsboard, zipkin...

CVE-2026-41506

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha....

CVE-2026-43322

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix UAF in lereadfeaturescomplete This fixes the following backtrace caused by hciconn being freed before lereadfeaturescomplete but after hcilereadremotefeaturessync so hciconndel - hcicmdsyncdequeue is not...

GHSA-FF6C-W6QF-7XQC vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-43286

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to subpool Commit a833a693a490 "mm: hugetlb: fix incorrect fallback for subpool" fixed an underflow error for hstate-resvhugepages caused by incorrectly attributing globally requeste...

GHSA-MJ4R-2HFC-F8P6 vulnerabilities

Vulnerabilities for packages: apache-nifi, celeborn, cassandra, akhq, flyway, selenium, tez, apache-pulsar, trino, zookeeper, apache-nifi-registry, wildfly, neo4j, management-api-for-apache-cassandra-5.0, keycloak, docker-selenium, thingsboard, kserve-modelmesh, infinispan, apache-activemq-artemi...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: codex, vector, deno, shadowsocks-rust, ztunnel, linkerd2-proxy...

GHSA-M4CV-J2PX-7723 vulnerabilities

Vulnerabilities for packages: apache-nifi, celeborn, akhq, flyway, selenium, tez, apache-pulsar, trino, apache-nifi-registry, neo4j, management-api-for-apache-cassandra-5.0, keycloak, docker-selenium, thingsboard, kserve-modelmesh, infinispan, apache-activemq-artemis, logstash, wavefront-proxy,...