CVE-2026-39396 OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

CVE-2026-39396 OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

CVE-2026-39396

OpenBao is vulnerable to a DoS via a decompression bomb in its OCI plugin extraction. Before version 2.5.3, ExtractPluginFromImage() streams decompressed tar data with no upper bound, using io.Copy without size checks. If an attacker controls the OCI registry, they can serve a crafted image that ...

PT-2026-34046

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.16 Description An issue exists in the Downloadable Link Handler component within the copy function. Remote manipulation of this function can lead to server-side request forgery, a flaw where an attacker can induce...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011243)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011243 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: zynqmp: Fix stack-out-of-bounds in strncpy BUG: KASAN: stack-out-of-bounds in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-010782)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010782 advisory. In the Linux kernel, the following vulnerability has been resolved: seccomp: Move copyseccomp to no failure path. Our syzbot instance reported memory leaks in...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011367)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011367 advisory. In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copyfromtouser for Niagara The referenced commit...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013216)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013216 advisory. In the Linux kernel, the following vulnerability has been resolved: net: stream: purge skerrorqueue in skstreamkillqueues Changheon Lee reported TCP socket leaks, wi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-006900)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006900 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VMPAT handling in COW mappings PAT handling won't do the right thing in COW...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013270)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013270 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix skb leak in skbtstamptx Commit 50749f2dd685 tcp/udp: Fix memleaks of sk and zerocopy skb...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011070)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011070 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix a memleak in multitransactionnew In multitransactionnew, the variable t is not free...

CVE-2026-6744: Server-Side Request Forgery (SSRF)

A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010951)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010951 advisory. In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifscopyfilerange If the file is used by swap, before return -EOPNOTSUPP,...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011237)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011237 advisory. In the Linux kernel, the following vulnerability has been resolved: rcu: Protect rcuprinttaskexpstall -exptasks access For kernels built with CONFIGPREEMPTRCU=y, the...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011364 advisory. In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copyfromtouser for UltraSPARC The referenced commit...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011009)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011009 advisory. In the Linux kernel, the following vulnerability has been resolved: net: stream: purge skerrorqueue in skstreamkillqueues Changheon Lee reported TCP socket leaks, wi...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-012998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-012998 advisory. In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copyfromtouser for Niagara The referenced commit...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010704)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010704 advisory. In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweightentity Syzbot found a GPF in reweightentity. This has been...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010917)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010917 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Prevent drmcopyfield to attempt copying a NULL pointer There are some struct drmdriver field...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013207)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013207 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may b...