CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

USN-8570-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block...

CVE-2026-64112

A flaw was found in the Linux kernel's Rados Block Device RBD module. A race condition exists in the lockdwork draining mechanism during the unmapping of an image. This allows the lockdwork to be re-queued after it is expected to be finalized, potentially leading to rbdacquirelock executing on...

CVE-2026-64141

A flaw was found in the ksmbd component of the Linux kernel. A remote attacker can trigger a null pointer dereference by negotiating a new session with a specific client identifier ClientGuid and issuing a Server Message Block SMB2 CREATE request with a lease context on a different inode after a...

CVE-2026-64048

A flaw was found in the Linux kernel's Server-Message-Block Direct SMC-D client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier CHID of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC...

Linux Distros Unpatched Vulnerability : CVE-2026-64182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drivers/base/memory: fix memory block reference leak in poison accounting memblknrpoisoninc and memblknrpoisonsub look up a memory block via findmemoryblockbyid...

Linux Distros Unpatched Vulnerability : CVE-2026-64135

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus/adm1266 widen blackbox-info buffer to I2CSMBUSBLOCKMAX adm1266nvmemreadblackbox declares a 5-byte stack buffer and passes it to...

PT-2026-61644

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the i2c-stub driver, a development and test tool. The stub xfer function fails to validate the transfer length against I2C SMBUS BLOCK MAX when handling the I2C SMBUS...

Linux Distros Unpatched Vulnerability : CVE-2026-64017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the...

Linux Distros Unpatched Vulnerability : CVE-2026-64085

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus/adm1266 bounce blackbox records through a protocol-sized buffer adm1266pmbusblockxfer copies the device-supplied block payload into the...

Linux Distros Unpatched Vulnerability : CVE-2026-64180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/memoryhotplug: fix memory block reference leak on remove Patch series mm: Fix memory block leaks and locking, v2. This series fixes two memory block device...

Linux Distros Unpatched Vulnerability : CVE-2026-64112

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's...

Linux Distros Unpatched Vulnerability : CVE-2026-64191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check...

Linux Distros Unpatched Vulnerability : CVE-2026-64142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against mfplist lookups ksmbddurablescavenger has two...

Linux Distros Unpatched Vulnerability : CVE-2026-63802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - blk-cgroup: fix UAF in blkcgrstatflush When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one...

MAL-2026-11044 Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

SUSE CVE-2026-63802

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in blkcgrstatflush When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's blkcgrstatflush removes another blkg's iostat entries via...

SUSE CVE-2026-63813

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in movedatablock" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almos...

CVE-2026-64180

In the Linux kernel, the following vulnerability has been resolved: mm/memoryhotplug: fix memory block reference leak on remove Patch series "mm: Fix memory block leaks and locking", v2. This series fixes two memory block device reference leaks and one locking issue around the per-memoryblock...

CVE-2026-64182

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: fix memory block reference leak in poison accounting memblknrpoisoninc and memblknrpoisonsub look up a memory block via findmemoryblockbyid, which acquires a reference to the memory block device. Both helpers...