5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +229 more potentially affected by CVE-2026-84370 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84370 Source advisory: SNYK:JS-SVGO-19498539...

UBUNTU-CVE-2026-75538

An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash the allocated block'...

MINI-QH3Q-QW9P-C4X4

Bulletin has no description...

MINI-V7MG-PWMM-292G

Bulletin has no description...

DEBIAN-CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

DEBIAN-CVE-2026-64106

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

DEBIAN-CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

Use After Free

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

DEBIAN-CVE-2026-45095

Bulletin has no description...

BELL-CVE-2026-13757

Bulletin has no description...

@adyen/adyen-salesforce-pwa (>=2.0.0, <=3.0.4), @amazeelabs/publisher (>=2.4.28, <=3.2.6) +202 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=3.0.0, <=3.0.5)

http-proxy-middleware NPM version =3.0.0, =2.0.0, =2.4.28, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.3, =1.0.0, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =21.2.2-depup.0, =21.2.7-depup.0 and more Source cves: CVE-2026-55602 Source advisory:...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @aiqadam/qadam-json (0.1.6) +71 more potentially affected by CVE-2026-12208 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =0.0.2, =1.0.0, =1.0.0, =4.0.0, =5.4.0 and more Source cves: CVE-2026-12208 Source advisory: SNYK:JS-JSONATA-17339139...

DEBIAN-CVE-2026-44171

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contai...

BELL-CVE-2026-46160

Bulletin has no description...

DEBIAN-CVE-2026-46139

In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c2d "smb: common: change the data type of numaces to le16" split struct smbacl's le32 numaces field into le16 numaces and le16 reserved. The...

DEBIAN-CVE-2026-46079

In the Linux kernel, the following vulnerability has been resolved: rbd: fix null-ptr-deref when deviceadddisk fails dorbdadd publishes the device with deviceadd before calling deviceadddisk. If deviceadddisk fails after deviceadd succeeds, the error path calls rbdfreedisk directly and then later...

BELL-CVE-2026-43354

Bulletin has no description...

RHSA-2026:19160 Red Hat Security Advisory: firefox security update

Bulletin has no description...

DEBIAN-CVE-2026-43035

In the Linux kernel, the following vulnerability has been resolved: net: sched: clsapi: fix tcchainfillnode to initialize tcminfo to zero to prevent an info-leak When building netlink messages, tcchainfillnode never initializes the tcminfo field of struct tcmsg. Since the allocation is not zeroed...

DEBIAN-CVE-2026-31756

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: gadget: Fix spinlock/unlock mismatch in dwc2hsotgudcstop dwc2gadgetexitclockgating internally calls callgadget macro, which expects hsotg-lock to be held since it does spinunlock/spinlock around the gadget driver...