CVE-2026-73513: Improper Input Validation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...

Linux Distros Unpatched Vulnerability : CVE-2026-93163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name alrea...

AZL-102882 CVE-2026-93163 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rnglist 4. May try to set rng to...

CVE-2026-93163

CVE-2026-93163 is a use-after-free vulnerability in the Linux kernel's hardware random number generator (hwrng) core subsystem. The root cause is in hwrng_register(): after adding a new RNG to the global rng_list, if the subsequent attempt to set it as current_rng fails, the function returns an e...

CVE-2026-93163: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rnglist 4. May try to set rng to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/meson: Remove DRM bridges when binding the aggregate driver The DRM bridges added by mesonencoderhdmiinit and mesonencodercvbsinit were not manually removed during module unloading, which caused dangling references to free...

UBUNTU-CVE-2026-89760

In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in the swap cache is freed when the folio leaves the cache, not when its count drops. swapputentriescluster follows that rule...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free through the dictionary handling in ZstdInputStreamNoFinalizer, ZstdOutputStreamNoFinalizer, ZstdCompressCtx, and ZstdDecompressCtx. An attacker can trigger native memory corruption or a JVM crash by closing a compression ...

UBUNTU-CVE-2026-80721

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

CVE-2026-80721 Bluetooth: ISO: ensure no dangling hcon references in iso_conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

PT-2026-83021

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth ISO implementation where ISO sockets may dereference the hcon reference after the iso conn del function has been called. This occurs because the clearing...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098842)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098842 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing putdisk when deviceadd&diskdev fails If deviceadd&sdkp-diskdev fails,...

CVE-2026-58161

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which f...

CVE-2026-58161

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

UBUNTU-CVE-2026-58161

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58161

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58592

Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to...

EUVD-2026-41130

Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to createhostfunction, whose ho...

CVE-2026-58592

Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to createhostfunction, whose ho...

CVE-2026-58592 Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration

Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to...