CVE-2026-101310 Multiple vulnerabilities in bhyve device models

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

CVE-2026-101310 Multiple vulnerabilities in bhyve device models

The HDA audio device model did not check for zero-length Buffer Descriptor List BDL entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious gue...

Xen: x86 DMs May Cause Mem Leak by IRQ Binding (XSA-509)

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest...

SUSE CVE-2026-62437

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest...

CVE-2026-62437 x86: DMs may cause mem leak by IRQ binding

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest...

CVE-2026-62437 x86: DMs may cause mem leak by IRQ binding

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest...

EUVD-2026-72719

When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest...

CVE-2026-62437

A flaw in Xen allows a guest virtual machine's device model (DM) to re-establish interrupt request (IRQ) tracking structures after the initial cleanup process during guest termination. This causes certain structures to remain unallocated, resulting in a memory leak . A local attacker with control...

PT-2026-87043

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description During the termination of guests, the cleanup of assigned PCI devices and the removal of tracking structures for Interrupt Requests IRQs occur early in the...

WhatsApp is testing a new warning for scam messages

Meta announced it’s rolling out a new feature for WhatsApp users in the fight against scammers. Scam Alert is an optional beta feature that uses an on-device machine-learning model to flag likely scam messages from people who are not in a user’s contacts. The Scam Alert feature arrives as scammer...

EUVD-2026-54805

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

MINI-G32F-F85R-5J46

Bulletin has no description...

MINI-H42R-86VR-VR23

Bulletin has no description...

MINI-W966-5FHH-CV64

Bulletin has no description...

MINI-WF3X-442W-VFFG

Bulletin has no description...

MINI-QMM3-J99W-H34X

Bulletin has no description...

MINI-W534-M3PM-MWHP

Bulletin has no description...

SUSE CVE-2026-62429

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

MINI-WJ2R-39XR-85C4

Bulletin has no description...

CVE-2026-62429

A flaw was found in Xen. A race condition exists where a guest's virtual Non-Uniform Memory Access vNUMA configuration data can be accessed by a device model even after the guest's domain destruction has started. This occurs because the cleanup of the vNUMA configuration is not synchronized with...