BIT-MONGODB-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

BIT-MASTODON-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100771)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100771 advisory. In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dllchange check The code checking whether the specified memory timing...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099972)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099972 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that t...

EUVD-2026-60448

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...

gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

gstreamer1-plugins-bad-free 1.22.12-7.4 - Fix ADPCM decoder negotiation and input size check CVE-2026-19387 Resolves: RHEL-235496 gstreamer1-plugins-ugly-free 1.22.12-6.2 - Fix integer overflows during bounds checks in asfdemux - Resolves: RHEL-235519...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101145 advisory. Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

The vulnerability in the `net/bluetooth/l2cap_core.c` component of the Linux operating system allows a hacker to gain access to confidential data and compromise its integrity.

The vulnerability of the net/bluetooth/l2capcore.c component in the Linux operating system is related to incorrect checking of the data size at the input stage. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099498 advisory. ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image...

ALSA-2026:55435 Important: gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fixes: gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds chec...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101322)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101322 advisory. Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Tenable h...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100135)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100135 advisory. In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099762 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de dm cache policy...

CVE-2026-65332: Improper Check or Handling of Exceptional Conditions

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...

PT-2026-73436

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer server handlers.go allowed prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup...

PT-2026-76688

A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management Windows deployments prior to version 26.1.2. Insufficient validation of input processed by the component may result in memory being accessed outside its intended bounds...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100932)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100932 advisory. Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12...

CVE-2026-68004

OSSRS SRS (Simple Realtime Server) versions

CVE-2026-65331: Improper Check or Handling of Exceptional Conditions

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash...