PT-2026-64678

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue in the virtio pci component can lead to a NULL pointer dereference when unbinding a virtio balloon device. This occurs due to an indexing mismatch in how virtual queue vq info...

CVE-2026-65527

The CVE-2026-65527 entry covers a Cross Site Scripting (XSS) vulnerability in the WordPress LIQUID SPEECH BALLOON plugin, affected versions

EUVD-2026-48128

Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...

WordPress LIQUID SPEECH BALLOON plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LIQUID SPEECH BALLOON versions = 1.2.6...

EUVD-2026-42230

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. This is due to missing or incorrect nonce validation on the maybeconnectiondata function. This makes it possible for...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: vmwballoon: Indicates success when effectively deflating during migration. When migrating a balloon page, we first deflate the old page, and then inflate the new page. However, if inflating the new page succeeds, we effectively...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: HV: hvballoon: fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must have had dput called upon it; otherwise, a memory leak would occur over time. To simplify things, simply call...

Unity Linux 20.1060a Security Update: kernel (UTSA-2026-014333)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014333 advisory. In the Linux kernel, the following vulnerability has been resolved: misc: vmwballoon: fix memory leak with using debugfslookup When calling debugfslookup the result...

CVE-2026-4089 Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Twittee Text Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in all versions up to and including 1.0.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The ttttwitteetweeter...

The vulnerability of the vmballoondebugfs_init() function in the drivers/misc/vmw_balloon.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the vmballoondebugfsinit function in the drivers/misc/vmwballoon.c module of the Linux kernel is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

USN-8029-3: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - RISC-V architecture; -...

USN-8048-1: Linux kernel (OEM) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - RISC-V architecture; -...

USN-8029-2 linux-aws, linux-oracle vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - RISC-V architecture; -...

USN-8030-1 linux-gcp vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - Nios II architecture; - PA-RISC architecture; - RISC-V architecture; -...

MiracleLinux 4 : qemu-kvm-0.12.1.2-2.355.AXS4.5 (AXSA:2013-473:03)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-473:03 advisory. KVM for Kernel-based Virtual Machine is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003663)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003663 advisory. An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of servic...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004139)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004139 advisory. An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of servic...

MiracleLinux 7 : kernel-3.10.0-1160.119.1.0.8.el7.AXS7 (AXSA:2025-9625:10)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9625:10 advisory. media: edia: dvbdev: fix a use-after-free CVE-2024-27043 btrfs: dev-replace: properly validate device names CVE-2024-26791 KVM: nSVM: Ignore nCR34:0...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000225)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000225 advisory. An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of servic...

SUSE CVE-2025-68248

In the Linux kernel, the following vulnerability has been resolved: vmwballoon: indicate success when effectively deflating during migration When migrating a balloon page, we first deflate the old page to then inflate the new page. However, if inflating the new page succeeded, we effectively...