Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003850)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003850 advisory. A flaw in netrdsallocsgs in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Base Score 6.2 Availability impacts. CVSS Vector...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001470)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001470 advisory. A flaw was found in the way memory resources were freed in the unixstreamrecvmsg function in the Linux kernel when a signal was pending. This flaw allows an...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003768)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003768 advisory. In the Linux kernel before 5.2.3, setgeometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and...

PT-2026-2281

Name of the Vulnerable Software and Affected Versions Avahi versions prior to 0.9-rc2 Description Avahi, a system for service discovery on a local network using the mDNS/DNS-SD protocol suite, is susceptible to a denial-of-service condition. An unprivileged local user can cause the avahi-daemon t...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000215)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000215 advisory. In the Linux kernel before 5.2.3, setgeometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and...

PT-2026-1436

Name of the Vulnerable Software and Affected Versions AirVPN Eddie version 2.24.6 Description The software contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root. Recommendations Update to a newer version that contains a fix for this...

CVE-2025-59529 simple protocol server ignores accepts unlimited connections and logs failures without limit

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although CLIENTSMAX ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414460 advisory. A flaw was found in the Linux kernels KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causi...

EUVD-2023-43972

Malicious code in bioql PyPI...

EUVD-2024-1086

Malicious code in bioql PyPI...

EUVD-2022-27696

Malicious code in bioql PyPI...

CVE-2025-23297

CVE-2025-23297 concerns NVIDIA App on Windows. The issue is in the FrameviewSDK installation process within the NVIDIA Installer for NvAPP for Windows, where a local unprivileged attacker could modify files in the Frameview SDK directory, potentially leading to privilege escalation. Documents con...

CVE-2025-5962

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or...

CVE-2025-53811

CVE-2025-53811 describes a TCC-related bypass in Mosh-Pro on macOS caused by misconfigured RunAsNode fuses. A local, unprivileged attacker could execute arbitrary code that runs with Mosh-Pro’s TCC permissions, limited to permissions the user has already granted. Additional resource access beyond...

kernel: net: fix udp gso skb_segment after pull from frag_list

A denial of service vulnerability has been discovered in the Linux kernel's UDP Generic Segmentation Offload GSO functionality. This flaw allows a local, unprivileged user to trigger a kernel crash by generating UDP packets with a specially malformed fraglist geometry. Successful exploitation of...

CVE-2023-49147

An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions e.g., an oplock on faxPrnInst.log to open...

CVE-2025-43922

The FileWave Windows client before 16.0.0, in some non-default configurations, allows an unprivileged local user to escalate privileges to SYSTEM...

Arbitrary File Read

github.com/canonical/pebble is vulnerable to a Arbitrary File Read. The vulnerability is due to the read-file API and the associated pebble pull command, allowing unprivileged local users to access files with root-equivalent permissions when Pebble is operating as root...

CVE-2024-3250

It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprivileged local users to read files with root-equivalent permissions when Pebble was running as root. Fixes are also available as backports to v1.1.1, v1.4.2,...

kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query

A NULL pointer dereference issue was found in the Linux kernel's vmwgfx driver in vmwcmddxdefinequery. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, who can issue an ioctl on the resulting file descriptor, to crash the system, causi...