CVE-2026-15762

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to an out-of-bounds write (CWE-787). This flaw could enable a remote attacker to achieve arbitrary code execution . The vulnerability is class...

USN-8902-1 libarchive vulnerability

It was discovered that libarchive had a signed integer overflow in its ZIP writer when handling encrypted entries with sizes near the maximum value. An attacker could possibly use this issue to cause libarchive to crash or execute arbitrary code...

USN-8902-1: libarchive vulnerability

It was discovered that libarchive had a signed integer overflow in its ZIP writer when handling encrypted entries with sizes near the maximum value. An attacker could possibly use this issue to cause libarchive to crash or execute arbitrary code...

glibc: Buffer Overflow in strfmon right-justification padding

A flaw was found in glibc. The strfmon and strfmonl functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker cou...

ROOT-APP-NPM-GHSA-5P4M-2WFM-XMQJ GHSA-5p4m-2wfm-xmqj in js-yaml - Patched by Root

Root has patched GHSA-5p4m-2wfm-xmqj in the js-yaml package for Root:npm. Multiple fixed versions available...

CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

CVE-2026-104658

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

CVE-2026-104658

Progressive Robot hMailServer versions 6.3.4 and 6.3.5 are vulnerable to a privilege escalation flaw in the hmailserver-update helper. The helper runs as root but processes a request file written by the unprivileged hmailserver service account. It improperly uses the program path for AppImage sig...

EUVD-2026-94832

The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...

CVE-2026-93523

A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that...

kernel: RDMA/rxe: Fix race condition in QP timer handlers

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA RXE component. A race condition exists between the retransmittimer and rxedestroyqp functions. This can cause a Queue Pair QP reference count to underflow, leading to a use-after-free vulnerability. A local attacker could...

CVE-2026-93699

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

Vulnerabilities present in Cisco NX-OS Software

Cisco has addressed several vulnerabilities in the Cisco NX-OS Software. These vulnerabilities concern various components of the Cisco NX-OS Software. - A vulnerability in the Python interpreter allows a malicious local attacker with low privileges to escape the Python sandbox and execute arbitra...

CVE-2026-93699

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

EUVD-2026-94799

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server...

kernel: ipv6: ioam: refresh hdr pointer before ioam6_event()

A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance IOAM component. This vulnerability, a use-after-free, occurs when the kernel fails to correctly update a pointer after reallocating a network packet's buffer. This oversight could allow an attacker to...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...