Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500137)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500137 advisory. - KVM: x86: Check for invalid/obsolete root after making MMU pages available Sean Christopherson Orabug: 39832946 CVE-2026-64561 - x86/bugs: Make...

Linux Distros Unpatched Vulnerability : CVE-2026-64585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - can: esdusb: kill anchored URBs before freeing netdevs esdusbdisconnect frees each CAN netdev with freecandev inside its per-netdev loop and only calls...

Linux Distros Unpatched Vulnerability : CVE-2026-64594

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is...

Linux Distros Unpatched Vulnerability : CVE-2026-64593

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: do not trim a device which is not writeable BUG There is a bug report that btrfs/242 can randomly fail with the following NULL pointer dereference: run...

Oracle Linux 10 : kernel (ELSA-2026-27288)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27288 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Security update for dnsdist (important)

openSUSE security update: security update for dnsdist ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21533-1 Rating: important References: bsc1269201 bsc1269202 bsc1269203 bsc1269204 bsc1269205 bsc1269206 bsc1269207 Cross-References: CVE-2026-40011...

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation CVE-2025-54518 Bug Fixes and Enhancements: Kernel...

TencentOS Server 4: kernel (TSSA-2026:0792)

"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0792 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilitie...

CVE-2026-19027

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

Important: Red Hat Security Advisory: Red Hat Quay 3.9.25

Red Hat Quay 3.9.25 is now available with bug fixes. Quay 3.9.25...

EUVD-2026-47646

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass...

CVE-2026-14587 Unathenticated connection can hold Bolt channel open

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for mo...

CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259

ESPHome (up to 2026.7.0-dev) is affected by an operator-precedence bug in the cv.url() validator within esphome/config_validation.py. The condition if parsed.scheme and parsed.netloc or parsed.scheme == "file" incorrectly permits file:// URIs to bypass validation, affecting the url: field of the ...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

EUVD-2026-53344

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.2.hum1 aarch64, x8664 tar-1.35-9.2.hum1.src src...

CVE-2026-71250

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...