AZL-99705 CVE-2026-86143 affecting package libxml2 for versions less than 2.11.5-11

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

libxml2 before 2.15.4 has an integer overflow in the xmlIO module. An inconsistency between xmlOutputWriteCallback and xmlBufUse causes negative length values to reach downstream write callbacks when data backlogs exceed maximum integer limits (approximately 2 GiB ). This can lead to data corrupt...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

EUVD-2026-71822

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

SUSE CVE-2026-80768

In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after-return write in I2C read race ft260i2cread points dev-readbuf at a caller-supplied buffer often an on-stack variable, arms a completion and waits up to five seconds for the device to return the dat...

SUSE CVE-2026-80842

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

SUSE CVE-2026-80849

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of currentkey on reconnect to another peer tcpinboundaohash is called before bhlocksocknested is taken, with only rcureadlock held. On the fast path for established sockets, if the rnextkeyid sent b...

SUSE CVE-2026-80872

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

PT-2026-86388

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

PT-2026-86304

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

PT-2026-86413

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

AZL-99489 CVE-2026-80872 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

CVE-2026-80872

CVE-2026-80872 affects the Linux kernel 's ALSA HDA TAS2781 driver (I2C and SPI variants). The TAS2781 driver queues RCA firmware loading via request_firmware_nowait(), whose async callback uses driver-private HDA state. During component unbind, controls and DSP state are removed immediately, and...

AZL-99546 CVE-2026-80836 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...

CVE-2026-80836

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...

CVE-2026-80827

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

AZL-99644 CVE-2026-80827 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80836 crypto: virtio - bound the akcipher result length

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akcipher result length virtiocryptodataqakciphercallback sets the result length from the device-reported response length without bounding it to the destination buffer, which was allocated for the origin...