Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer...

ALSA-2026:47180 Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer...

CVE-2026-64543 tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with tipcdiscdelete's plain kfree, but tipcdiscrcv still dereferences b-disc in RX softirq under rcureadlock tipcudprecv - tipcrcv - tipcdiscrcv...

EUVD-2026-49594

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with tipcdiscdelete's plain kfree, but tipcdiscrcv still dereferences b-disc in RX softirq under rcureadlock tipcudprecv - tipcrcv - tipcdiscrcv...

CVE-2026-17531 unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17531 unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17531

CVE-2026-17531 affects unitedbyai droidclaw up to version 0.5.3. The vulnerability is in an unspecified aspect of file server/src/routes/goals.ts (Unsigned Scheduled Callback) and enables authorization bypass. Remote exploitation is possible, with high complexity and a PROOF-OF-CONCEPT exploit pu...

CVE-2026-17531 unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-9830 BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-9830 BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

CVE-2026-9830

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

BIT-OPENBAO-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...

BIT-OPENBAO-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...

UBUNTU-CVE-2026-64211

In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcustruct structure is in the midst of switching from CPU-0 to all-CPUs state, it can attempt to invoke callbacks for CPUs that have never been online. Worse yet...

PT-2026-65051

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback mode=direct configured are vulnerable to XSS via the error description parameter on the page for a failed...

UBUNTU-CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

SUSE CVE-2026-64266

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fusereffolio fusereffolio unlocks the request but does not re-lock it before returning. fusechanabort can end the request and the async end callback eg fusewritepagefree can free the ar...

SUSE CVE-2026-64312

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcryptaeaddone on the child AEAD request before trying to submit it through padata. If padatadoparallel returns -EBUSY, pcrypt falls back to calling the...

SUSE CVE-2026-64362

In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lgg15data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lgg15event and lgg15v2event do it on th...

SUSE CVE-2026-64365

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...