CVE-2026-43428

In the Linux kernel, the following vulnerability has been resolved: USB: core: Limit the length of unkillable synchronous timeouts The usbcontrolmsg, usbbulkmsg, and usbinterruptmsg APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the...

CVE-2026-43429

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Use usbbulkmsgkillable with user-specified timeouts The usbtmc driver accepts timeout values specified by the user in an ioctl command, and uses these timeouts for some usbbulkmsg calls. Since the user can specify...

CVE-2026-43424

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: Fix NULL pointer dereferences in nexus handling The tpg-tpgnexus pointer in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can be NULL if the USB host sends...

CVE-2026-43365

In the Linux kernel, the following vulnerability has been resolved: xfs: fix undersized liclogroundoff values If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k...

CVE-2026-43362

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2write SMB2write places write payload in iov1..n as part of rqiov. smb3inittransformrq pointer-shares rqiov, so cryptmessage encrypts iov1 in-place, replacing the original...

CVE-2026-22740 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2026-42561 vulnerabilities

Vulnerabilities for packages: reflex, airflow, semgrep...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: zipkin, thingsboard, keycloak-config-cli, apache-nifi-registry...

CVE-2026-41506

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha....

CVE-2026-43322

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix UAF in lereadfeaturescomplete This fixes the following backtrace caused by hciconn being freed before lereadfeaturescomplete but after hcilereadremotefeaturessync so hciconndel - hcicmdsyncdequeue is not...

GHSA-FF6C-W6QF-7XQC vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-43286

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to subpool Commit a833a693a490 "mm: hugetlb: fix incorrect fallback for subpool" fixed an underflow error for hstate-resvhugepages caused by incorrectly attributing globally requeste...

GHSA-MJ4R-2HFC-F8P6 vulnerabilities

Vulnerabilities for packages: akhq, kserve-modelmesh, flyway, trino, management-api-for-apache-cassandra-5.0, docker-selenium, keycloak, apache-pulsar, cassandra, strimzi-kafka-operator, wavefront-proxy, spark, selenium, druid, apicurio-registry, neo4j, logstash, apache-nifi, opensearch, wildfly,...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, vector, deno, shadowsocks-rust, ztunnel...

GHSA-M4CV-J2PX-7723 vulnerabilities

Vulnerabilities for packages: akhq, kserve-modelmesh, flyway, trino, management-api-for-apache-cassandra-5.0, docker-selenium, keycloak, apache-pulsar, strimzi-kafka-operator, tez, wavefront-proxy, spark, selenium, druid, apicurio-registry, neo4j, logstash, apache-nifi, opensearch, infinispan,...

GHSA-HF2P-G3JQ-W2MX vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-aws, linux-gcp...

CVE-2026-31696 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-aws, linux-qemu-rc, linux-gcp...

GHSA-P5WW-JRFV-82QX vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-aws, linux-qemu-rc, linux-gcp...

GHSA-PG4W-G64P-QWHJ vulnerabilities

Vulnerabilities for packages: cargo-audit, jujutsu...

GHSA-P3HW-MV63-RF9W vulnerabilities

Vulnerabilities for packages: cargo-audit, jujutsu...