SUSE-SU-2026:20716-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. bsc1255400 - CVE-2026-0665: Fixed PIRQ bounds check in xenphysdevmappirq. bsc1256484...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

The vulnerability of the af_alg_sendmsg() function in the crypto/af_alg.c module of the Linux kernel’s cryptographic subsystem allows a hacker to induce a service failure.

The vulnerability of the afalgsendmsg function in the crypto/afalg.c module of the Linux kernel’s cryptographic subsystem is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the bpf_crypto_crypt() function in the kernel/bpf/crypto.c module, which is part of the BPF interpreter support for the Linux operating system, allows a attacker to compromise the integrity of protected information or cause service failures.

The vulnerability of the bpfcryptocrypt function in the kernel/bpf/crypto.c module, which is part of the Linux operating system’s BPF interpreter support, relates to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise t...

Fake CleanMyMac Site Uses ClickFix Trick to Install SHub Stealer on macOS

Researchers warn of a fake CleanMyMac site using a ClickFix attack to install SHub Stealer on macOS and steal passwords and crypto wallets...

MiracleLinux 9 : delve-1.25.2-2.el9_7 (AXSA:2026-275:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-275:01 advisory. crypto/tls: Unexpected session resumption in crypto/tls CVE-2025-68121 Tenable has extracted the preceding description block directly from the MiracleLinux...

CVE-2026-30909

Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcmencryptafternm and seal functions do not check that output size will be less than SIZEMAX, which could lead to integer wraparound causing an undersized output buffer. Encountering this...

SUSE SLED15: qemu / qemu-SLOF / qemu-accel-qtest / qemu-accel-tcg-x86 / qemu-arm / etc (SUSE-SU-2026:0832-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0832-1 advisory. Security issue: - CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto bsc1255400. Non security issues: -...

CVE-2026-27137

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered...

CVE-2026-27137 Incorrect enforcement of email constraints in crypto/x509

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered...

Malicious code in python-requirements (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 40fa77c47c3649fce85f601f8aa10bf13674e5db4a2d35f125cb48b77d65f99d The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current...

MAL-2026-1264 Malicious code in python-requirements (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 40fa77c47c3649fce85f601f8aa10bf13674e5db4a2d35f125cb48b77d65f99d The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current...

Malicious code in python-module-installer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61bfa181c5afb9e33e0d529138c813fc05d8130062182d9d1a5cb4ef9c8da0ea The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current...

TencentOS Server 4: qemu (TSSA-2026:0110)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0110 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SUSE SLES12 Security Update : docker (SUSE-SU-2026:0772-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0772-1 advisory. - CVE-2025-58181: Fixed a bug in crypto/ssh where invalidated number of mechanisms can cause unbounded memory consumption. bsc1253904 Tenable has...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : QEMU vulnerabilities (USN-8073-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8073-1 advisory. It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the gues...

Security update for qemu

This update for qemu fixes the following issues: Security issue: CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto bsc1255400. Non security issues: hw/virtio: Also include md stubs in case CONFIGVIRTIOPCI is not set jscPED-14271. s390x/pv: prepare for memory devices jscPED-14271...

SUSE-SU-2026:0832-1 Security update for qemu

This update for qemu fixes the following issues: Security issue: - CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto bsc1255400. Non security issues: - hw/virtio: Also include md stubs in case CONFIGVIRTIOPCI is not set jscPED-14271. - s390x/pv: prepare for memory devices...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005777)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005777 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of...