CVE-2026-92151

The F´ (F Prime) framework, used for spaceflight and embedded software applications, contains a vulnerability in the Svc::Ccsds::SpacePacketDeframer component prior to version 4.2.0 . The dataIn_handler incorrectly uses FW_ASSERT instead of rejecting the buffer when a CCSDS telecommand frame resu...

CVE-2026-92151 F´: SpacePacketDeframer Small Packet Assertion DoS

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::Ccsds::SpacePacketDeframer dataInhandler is vulnerable because the handler treats the minimum packet-length condition as FWASSERT rather than rejecting a...

CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

CVE-2026-78231

The software Gitea is vulnerable to a blind Server-Side Request Forgery (SSRF) when OpenID sign-in is enabled. The root cause is that Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to a caller-supplied OpenID provider endpoint during verification. An attacker ...

DEBIAN-CVE-2026-98391

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391

The Linux kernel contains a vulnerability in the drm/xe driver where the asynchronous dropping of a VM's runtime PM reference during teardown allows a device to autosuspend while stale page faults remain queued. When the page-fault worker attempts to acknowledge these faults, it calls guc_ct_send...

EUVD-2026-101040

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. CVE-2026-80274: Validating resolver can abort while...

SUSE-SU-2026:4657-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. - CVE-2026-80274: Validating resolver can abort whi...

CVE-2026-102064: Reachable Assertion

A Reachable Assertion vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to cause rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer...

SUSE SLES12: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2026:4635-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4635-1 advisory. - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. - CVE-2026-19662:...

PT-2026-114370

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98391: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-78231: Server-Side Request Forgery (SSRF)

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

PT-2026-114290

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When OpenID sign-in is enabled, the software processes unauthenticated assertion parameters and sends an HTTP POST request to a caller-supplied OpenID provider endpoint during verification. Thi...