openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

EUVD-2026-92758

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1773136115)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773136115 advisory. - When passing data to the b64decode, standardb64decode, and urlsafeb64decode functions in the base64 module the characters +/ will...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

CVE-2026-64058

A flaw was found in the Linux kernel's network file system netfs component. The netfsreadfolio function fails to wait for ongoing writeback operations to complete. This can lead to the system incorrectly trusting the dirty flag and prematurely cleaning up private data associated with a folio,...

undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing

A flaw was found in undici. When using Socks5ProxyAgent, undici incorrectly reuses a single connection pool across different origins. This can lead to cross-origin request routing, where sensitive credentials and data intended for one destination are sent to another. Consequently, responses from...

vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass

A flaw was found in Vim's zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or furth...

SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:2468-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2468-1 advisory. This update for amazon-ssm-agent fixes the following issues Update to version 3.3.4624.0: - CVE-2025-22869: golang.org/x/crypto/ssh...

SUSE-SU-2026:2467-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues Update to version 3.3.4624.0: - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh bsc1239342. - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs bsc1238702. ...

OPENSUSE-SU-2026:21079-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues Update to version 3.3.4624.0: - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh bsc1239342. - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs bsc1238702. ...

kernel: crypto: algif_aead - Revert to operating out-of-place

A flaw was found in the Linux kernel's algifaead cryptographic algorithm interface. An incorrect in-place operation causes source and destination data mappings to differ during cryptographic processing. A low-privileged local attacker can exploit this flaw to corrupt the contents of sensitive...

kernel: Linux kernel: Denial of service and memory corruption in RDMA umad

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA umad User Mode Access Device component. A local user can exploit this vulnerability by manipulating input, causing an integer underflow that leads to an out-of-bounds memory write. This memory corruption can result in a denia...

Security update for python311

This update for python311 fixes the following issues: CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters bsc1257029. CVE-2025-12781: inadequate parameter check can cause data integrity issues bsc1257108. CVE-2025-15282:...

HSEC-2024-0008 Sign extension error in the PPC64le FFI

Sign extension error in the PPC64le FFI Numeric arguments of FFI call on the PPC64le backend may result in incorrect runtime values. For the most part, this bug only causes availability and data integrity issues. However, in some circumstances, it may result in other, more complicated security...

HSEC-2024-0006 fromIntegral: conversion error

fromIntegral: conversion error fromIntegral may result in coercion errors when used with optimization flags -O1 or -O2 in the following situation: - Converting negative Int to Natural does not throw an arithmetic underflow error - Converting large Integer greater than 2^64 to Natural overflow. Fo...

HSEC-2024-0007 Sign extension error in the AArch64 NCG

Sign extension error in the AArch64 NCG Arithmetic operations may result in incorrect runtime results on the native aarch64 backend. For the most part, this bug only causes availability and data integrity issues. However, in some circumstances, it may result in other, more complicated security...