Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006943)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006943 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix ABBA deadlock between shrinkslab and dmpoolabortmetadata Following concurrent...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010831)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010831 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix ABBA deadlock between shrinkslab and dmpoolabortmetadata Following concurrent...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013185)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013185 advisory. In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: avoid SBSA UART accessing DMACR register Chapter B Generic UART in ARM Server...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013238)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013238 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix ABBA deadlock between shrinkslab and dmpoolabortmetadata Following concurrent...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011041 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: release mutex after nftgcseqend from abort path The commit mutex should not ...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011184)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011184 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix warning when putting transaction with qgroups enabled after abort If we have a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007477)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007477 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: always panic when errors=panic is specified Before commit 014c9caa29d3 ext4: make ext4abort...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007429)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007429 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007611)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007611 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix link down processing to address NULL pointer dereference If an FC link down...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007315 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix memleak in map from abort path The delete set command does not rely on t...

PT-2026-51963

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference exists in the xdp master redirect function. This occurs when the function attempts to call the master's ndo xdp get xmit slave while the master device is not u...

PT-2026-43970

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the stream parser when it is aborted, such as after a message assembly timeout. The strp abort strp function fails to release the reference to a partially assembl...

CVE-2026-25204

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335...

CVE-2026-25204: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335...

CVE-2026-40071

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/packageorder, /json/linkorder, and /json/abortlink WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execut...

glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory

A flaw was found in glibc. When the wordexp function is called with the flags WRDEREUSE and WRDEAPPEND, it may return uninitialized memory. If the caller inspects the wewordv array or calls the wordfree function to free the allocated memory, the process will abort, resulting in a denial of servic...

GHSA-RFGH-63MG-8PWM pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

Summary Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. Confirmed mismatches: - ADD user can reorder packages/files...

pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

Summary Several WebUI JSON endpoints enforce weaker permissions than the core API methods they invoke. This allows authenticated low-privileged users to execute MODIFY operations that should be denied by pyLoad's own permission model. Confirmed mismatches: - ADD user can reorder packages/files...

PT-2026-34989

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The rxkad decrypt ticket function decrypts the RXKAD response ticket but parses the buffer as plaintext without verifying if the crypto skcipher decrypt operation was successful. A...

GHSA-MFJ6-6P54-M98C parse-server has GraphQL complexity validator exponential fragment traversal DoS

Impact The GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects...