Linux Distros Unpatched Vulnerability : CVE-2026-90121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS...

Linux Distros Unpatched Vulnerability : CVE-2026-93174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Copy per-CPU map value padding in copymapvaluelong In kernel, per-CPU map elements are stored with roundupmap-valuesize, 8 bytes. On UAPI lookup paths, it...

EulerOS Virtualization 2.11.0 : zlib (EulerOS-SA-2026-3571)

According to the versions of the zlib packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop...

CVE-2026-63446: Missing Release of Memory after Effective Lifetime

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows...

CVE-2026-71418: Inefficient Algorithmic Complexity

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer...

CVE-2026-84446: Loop with Unreachable Exit Condition

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::initsampletimingtable compute a logical mnumoutputsamples value that exceeds the uint32t counters used by TrackVisual::decodenextimagesample and...

Linux Distros Unpatched Vulnerability : CVE-2026-90370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response...

EulerOS Virtualization 2.11.1 : zlib (EulerOS-SA-2026-3483)

According to the versions of the zlib packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop...

Linux Distros Unpatched Vulnerability : CVE-2026-92492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks cpufreqcpuget returns NUL...

Linux Distros Unpatched Vulnerability : CVE-2026-93168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: xilinxdma: Fix CPU stall in xilinxdmapolltimeout Currently when calling xilinxdmapolltimeout with delayus=0 and a condition that is never fulfilled,...

Linux Distros Unpatched Vulnerability : CVE-2026-93653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

Security Bulletin: brace-expansion-2.1.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary brace-expansion 2.1.1 affected by CVE-2026-13149 — exponential CPU consumption in expand via consecutive non-expanding brace groups, causing event-loop blocking DoS. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (CPU)

Red Hat AI Base Images 3.3.3 CPU is now available. Red Hat® AI Base Images...

DEBIAN-CVE-2026-93174

In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copymapvaluelong In kernel, per-CPU map elements are stored with roundupmap-valuesize, 8 bytes. On UAPI lookup paths, it copies the rounded size for each CPU into a temporary buffer. However...

CVE-2026-93168

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix CPU stall in xilinxdmapolltimeout Currently when calling xilinxdmapolltimeout with delayus=0 and a condition that is never fulfilled, the CPU busy-waits for prolonged time and the timeout triggers only...

DEBIAN-CVE-2026-93168

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix CPU stall in xilinxdmapolltimeout Currently when calling xilinxdmapolltimeout with delayus=0 and a condition that is never fulfilled, the CPU busy-waits for prolonged time and the timeout triggers only...