[SECURITY] Fedora 44 Update: btrbk-0.32.7-1.fc44

Backup tool for btrfs sub-volumes, using a configuration file, allows creation of backups from multiple sources to multiple destinations, with ssh and flexible retention policy support hourly, daily, weekly, monthly...

CVE-2026-64006

A flaw was found in the Linux kernel's Netfilter nftables component. This vulnerability occurs during lshift and rshift operations when the source and destination registers point to the same memory location. An incorrect calculation of the carry value, using the modified destination instead of th...

CVE-2026-63975

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789

CVE-2026-15789 affects the BuildKit daemon: a custom client with valid BuildKit API access can craft upload requests that bypass destination directory validation, allowing files to escape the BuildKit-controlled state directory. This is a local-privilege issue that requires access to the BuildKit...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

SUSE CVE-2026-63975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

Exploit for Heap-based Buffer Overflow in F5 Nginx_Plus

CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Hand...

Exploit for Heap-based Buffer Overflow in F5 Nginx_Plus

CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Hand...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and...

CVE-2026-39879

CVE-2026-39879 affects syslog-ng before version 4.12, where a missing sanitization in afsql_dd_run_query can allow SQL injection from an untrusted source when using the SQL destination driver (not enabled by default). The issue lies in the afsql.c component (afsql_dd_run_query) and is exploitable...

CVE-2026-63751

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

BIT-RCLONE-2026-59732 rclone archive extract allows S3 destination prefix escape via crafted archive paths

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...

BIT-RCLONE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...

SUSE CVE-2026-63794

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

CVE-2026-63975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

CVE-2026-64006

The CVE affects Linux kernel netfilter nf_tables. A dst corruption in the same-register operation occurred during shift (lshift/rshift) when src and dst pointed to the same memory location: the carry for the next iteration was read from the dst (modified) instead of the original src. The fix cach...