DEBIAN-CVE-2026-54258

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

CVE-2026-45056

matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing t...

UBUNTU-CVE-2026-54258

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...

CVE-2026-90454 Missing authorization in Malcolm

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90454 Missing authorization in Malcolm

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-90450

CVE-2026-90450 is a fail-open authorization flaw in which the application's role-authorization lookup grants access by default when a request handler is not present in its table of role requirements. Consequently, any request handler not explicitly registered in the table is reachable by any auth...

CVE-2026-44715

OpenMRS , an open-source electronic medical record platform, is affected by a Broken Access Control vulnerability in its HL7 configuration. Prior to versions 1.23.0 and 2.10.0 , the administrative DWR method startHl7ArchiveMigration, which should be restricted to admin-level accounts, is accessib...

CVE-2026-49464

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

EUVD-2026-76692

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

DEBIAN-CVE-2026-89750

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

UBUNTU-CVE-2026-89767

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double endcreating on the casefold-mismatch path ovlcreatereal releases the new dentry twice when the casefold consistency check fails. The SIFDIR branch calls endcreating and sets err, then falls through to the common...

DEBIAN-CVE-2026-89584

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

CVE-2026-89584

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

DEBIAN-CVE-2026-89571

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...

CVE-2026-89507

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

DEBIAN-CVE-2026-81009

In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry clamps hdr.size for the inbound copyfromuser but keeps the original user value as usize. copystructtouser uses that usize and, when it is larger than the...

UBUNTU-CVE-2026-89584

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

CVE-2026-89584

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

CVE-2026-49463

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-89767

CVE-2026-89767 is a Linux kernel overlayfs vulnerability in ovl_create_real(). When the casefold consistency check fails during directory creation, end_creating() is called twice on the same dentry, causing a double unlock of the parent directory's i_rwsem and a double dput() . The second unlock ...