kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O

A flaw was found in the Kernel-based Virtual Machine KVM for x86. This vulnerability occurs when KVM incorrectly re-checks Level 1 L1 intercepts during the completion of userspace I/O emulation for a Level 2 L2 instruction. If the L1 or host userspace modifies I/O interception settings during thi...

OPENSUSE-SU-2026:11370-1 python-magic-wormhole-bash-completion-0.24.0-1.1 on GA media

These are all security issues fixed in the python-magic-wormhole-bash-completion-0.24.0-1.1 package on the GA media of openSUSE Tumbleweed...

CLSA-2026-1784807557 vim: Fix of CVE-2026-59858

CVE-2026-59858: escape the typeref/typename tags field before interpolating it into the :vimgrep pattern in ccomplete.vim s:StructMembers, preventing arbitrary Ex command execution during C omni-completion upstream 9.2.0735...

CLSA-2026-1784802165 vim: Fix of CVE-2026-59858

CVE-2026-59858: fix arbitrary Ex command execution during C omni-completion; the typeref/typename tag field was interpolated unescaped into a :vimgrep pattern run via :execute, letting a crafted tags file close the pattern and append an Ex command; escape the type field with escapetypename, '/'...

CLSA-2026-1784799711 Fix CVE(s): CVE-2026-59858

SECURITY UPDATE: arbitrary Ex command execution during C omni-completion: the C omni-completion script interpolated the typeref/typename tag field of a tags entry, without escaping, into a :vimgrep pattern run through :execute. Because :vimgrep honours the bar as a command separator, a crafted ta...

CLSA-2026-1784799471 vim: Fix of CVE-2026-59858

CVE-2026-59858: fix arbitrary Ex command execution during C omni-completion; the typeref/typename tag field was interpolated unescaped into a :vimgrep pattern run via :execute, letting a crafted tags file close the pattern and append an Ex command; escape the type field with escapetypename, '/'...

CLSA-2026-1784799349 vim: Fix of CVE-2026-59858

CVE-2026-59858: fix arbitrary Ex command execution during C omni-completion; the typeref/typename tag field was interpolated unescaped into a :vimgrep pattern run via :execute, letting a crafted tags file close the pattern and append an Ex command; escape the type field with escapetypename, '/'...

RLSA-2026:42096 Important: c-ares security update

The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. Security Fixes: c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 For more details about the security issues, including the impact, a CVSS score,...

SUSE-SU-2026:22901-1 Security update for vim

This update for vim fixes the following issues - Updated to version 9.2.0780 - CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion bsc1271194. - CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding bsc1271195. - CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion...

SUSE CVE-2026-64103

In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in iscihostalloc drivers/scsi/isci/init.c:496 and scheduled from both MSI-X and legacy interrupt handlers...

kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface uAPI that cause an internal error. This issue arises when Work Queues WQs are specified to share the...

kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface uAPI that cause an internal error. This issue arises when Work Queues WQs are specified to share the...

CVE-2026-14184

The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as complet...

PT-2026-61837

The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as complet...

MiracleLinux 8 : vim-8.0.1763-27.el8_10.ML.1 (AXSA:2026-1312:17)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1312:17 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3804 (ALAS-2026-3804)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3804 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iterative...

c-ares: c-ares: Use-after-free / double-free in query-completion handling

A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via aresgetaddrinfo over TCP by sending crafte...

Important: Red Hat Security Advisory: c-ares security update

An update for c-ares is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

ALSA-2026:42096 Important: c-ares security update

The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. Security Fixes: c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 For more details about the security issues, including the impact, a CVSS score,...

Important: nodejs24

Issue Overview: A use-after-free / double-free in c-ares' query-completion handling. The same flaw -- a query's callback being invoked while the query is still linked in the channel's internal lookup structures -- is present at multiple points in the resend/finish path timeout handling, response...