ROS-20260721-73-0036

The vulnerability of the WebCodecs interface in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-64627: Generation of Error Message Containing Sensitive Information

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

PT-2026-63797

Summary Repo.clone from passes the caller-supplied remote URL through Git.polish url, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clone from in "import repository fro...

CVE-2026-16417: Use of Uninitialized Variable

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-16417: Use of Uninitialized Variable

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

USN-8562-1: FreeType vulnerability

It was discovered that FreeType incorrectly handled certain variable font files. An attacker could possibly use this issue to cause FreeType to crash, resulting in a denial of service, or obtain sensitive information...

USN-8562-1 freetype vulnerability

It was discovered that FreeType incorrectly handled certain variable font files. An attacker could possibly use this issue to cause FreeType to crash, resulting in a denial of service, or obtain sensitive information...

PT-2026-62024

It was discovered that FreeType incorrectly handled certain variable font files. An attacker could possibly use this issue to cause FreeType to crash, resulting in a denial of service, or obtain sensitive information...

AZL-92829 CVE-2026-64082 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

CVE-2026-64092

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64056

The CVE covers a Linux kernel issue in the Cortina ethernet driver. The RX socket buffer (SKB) used to assemble fragments in gmac_rx() was a static local variable, which could race on devices with two ethernet ports (Gemini) when both ports are active. The fix makes the RX SKB a per-port variable...

CVE-2026-64034 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-64024 tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcpconnrequest for the sam...

CVE-2026-64006 netfilter: nf_tables: fix dst corruption in same register operation

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

CVE-2026-64174: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

The Finite Key Effect of Side-Channel-Secure Quantum Key Distribution beyond Post-Selection Technique

By applying the framework of entropic uncertainty relation EUR and the Quantum Leftover Hash Lemma QLHL, we introduce a security-proof method for variable-length side-channel-secure SCS quantum key distribution QKD against coherent attacks. This method reframes composable security as a statistica...

CVE-2026-63936: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358readimp In mt6358readimp, the variable valv is passed to regmapread but the return value is not checked. If the read fails, valv remains uninitialized and its random stack...

Denial Of Service (DoS)

websocket-driver is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of variable-length WebSocket frame length headers, which allows an attacker to send an indefinite sequence of high-bit-set bytes 0x80 or above, causing the server to parse an ever-growing intege...

Malicious code in knot-rspec-formatter-json (RubyGems)

Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal credentials, set up ssh access and tamper with build/workfl...