PT-2026-99157

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

CVE-2026-69186 c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer invokes parsing before transaction ID and...

CVE-2026-93596

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

SUSE CVE-2026-93101

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

Linux Distros Unpatched Vulnerability : CVE-2026-90168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: retain connection for pending notify work Deferred CHANGENOTIFY work keeps an async message ID after the original request work is released. A durable...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109817)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109817 advisory. FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When...

Linux Distros Unpatched Vulnerability : CVE-2026-93101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause i...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders

A flaw was found in FreeRDP. When the async-update feature is enabled, a malicious or compromised Remote Desktop Protocol RDP server can send specially crafted update orders. This can lead to an out-of-bounds read, potentially exposing sensitive information or causing the client application to...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information through proxy-auth handling in NettyRequestFactory.newNettyRequest and...

Improper Resource Shutdown or Release

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Resource Shutdown or Release due to NettyConnectListener.onSuccess in the Netty connect path. An attacker can exhaust maxConnections...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect authentication path in Interceptors.java. An attacker can obtain client-wide realm...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the newNettyRequest and writeRequest/sendRequestWithNewChannel paths in NettyRequestFactory and...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through ChannelManager.newHttpContentDecompressor in...

Detection of Error Condition Without Action

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Detection of Error Condition Without Action via the SCRAM processScramAuthenticationInfo path and the Digest processAuthenticationInfo path i...

CVE-2026-93101

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

AZL-102942 CVE-2026-93101 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

DEBIAN-CVE-2026-93101

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Unregister sub-device if asclist is empty When my em28xx USB device that uses the i2c tvp5150 driver is disconnected, it crashes. The cause is that the tvp5150 i2c module uses v4l2async, but the em28xx driver...

CVE-2026-90168

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

AZL-102810 CVE-2026-90168 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: retain connection for pending notify work Deferred CHANGENOTIFY work keeps an async message ID after the original request work is released. A durable handle can outlive its connection, so the connection teardown can destro...