CVE-2026-50772

Squirro Cognitive Search versions below 3.14.2 contain a flaw in the password reset function allowing unauthenticated remote attackers to execute arbitrary code, rated CVSS 9.8 Critical. A proof-of-concept exploit is available at https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50772; up...

Important: libssh2

Issue Overview: libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099713)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099713 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099751)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099751 advisory. In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskbcarve helpers pskbcarveinsideheader and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100548)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100548 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of old filters before change Like pointed out by Sashiko 1...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100563)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100563 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrmsendmigrate in net/xfrm/xfrmuser.c and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100531)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100531 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpinfitinit error cleanup If acpinfitinit fails after adding the acpidesc...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100512)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100512 advisory. In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the...

The vulnerability of the wbrf_record() function in the drivers/platform/x86/amd/wbrf.c module of the X86 device driver framework of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the wbrfrecord function in the drivers/platform/x86/amd/wbrf.c module of the Linux X86 kernel device driver lies in improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the iccdebugfs_client_init() function in the drivers/interconnect/debugfs-client.c module of the Linux kernel’s interconnection driver allows a attacker to cause a service failure.

The vulnerability of the iccdebugfsclientinit function in the drivers/interconnect/debugfs-client.c file of the Linux kernel’s interconnection driver module relates to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the octep_device_setup() function in the drivers/net/ethernet/marvell/octeon_ep/octep_main.c file of the Ethernet network adapter driver for the Marvell-based Linux operating system allows a hacker to cause a service failure.

The vulnerability of the octepdevicesetup function in the drivers/net/ethernet/marvell/octeonep/octepmain.c file of the Ethernet network adapter driver for the Linux operating system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a system...

The vulnerability of the `ice_vsi_set_napi_queues()` function in the `drivers/net/ethernet/intel/ice/ice_lib.c` file of the Intel Ethernet network adapter driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the icevsisetnapiqueues function in the drivers/net/ethernet/intel/ice/icelib.c file of the Intel Ethernet network adapter driver for the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-73199

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update langs of the component Language Update. Performing...

PT-2026-76718

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

Medium: python-idna

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

CVE-2026-67918

CVE-2026-67918 is a directory traversal vulnerability in hermes-studio v.0.6.26 , located in the validatePath() function within the api/hermes/download endpoint. A remote, unauthenticated attacker can exploit this flaw to access files and directories outside the intended folder, resulting in sens...

The vulnerability of the trigger_kthread_fn() function in the kernel/trace/traceeventstrigger.c module, which supports kernel tracing in Linux operating systems, allows a hacker to cause a service failure.

The vulnerability of the triggerkthreadfn function in the kernel/trace/traceeventstrigger.c module, which supports kernel tracing in Linux operating systems, relates to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100369)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100369 advisory. In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be...

Unity Linux 20.1070e Security Update: binutils (UTSA-2026-099446)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099446 advisory. A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tgtagtype of the file prdbg.c. Performing manipulation results in unchecked return...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100161)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100161 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfeventoutput We received report 1 of kernel crash, which is caused b...