CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-74516

A flaw was found in KVM Kernel-based Virtual Machine. When the Advanced Virtual Interrupt Controller AVIC is inhibited while a nested guest L2 is active, KVM fails to properly update x2APIC MSR intercepts for the primary guest L1. This allows the L1 guest to read the host's APIC state, send...

OpenJDK: Enhance TLS server (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle...

CVE-2026-74447

A flaw was found in the Linux kernel's drm/amdkfd component. An integer overflow vulnerability exists when aligning the End-of-Pipe EOP ring buffer size. A local attacker could exploit this by providing a specially crafted size that, due to a 32-bit integer overflow, causes the system to bypass...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-42577 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to...

CVE-2026-74537

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A race condition in the isoconnready function allows a socket to be prematurely freed while still in use. This Use-After-Free UAF vulnerability could lead to memory corruption, potentially causing a system crash or other unpredictabl...

CVE-2026-74531

A flaw was found in the Bluetooth hciconn component of the Linux kernel. A theoretical Use-After-Free UAF vulnerability exists if a connection conn is prematurely freed while the hcisync task is still active. This could potentially allow an attacker to cause a system crash or execute arbitrary co...

CVE-2026-74446

A flaw was found in the drm/amdkfd component of the Linux kernel. A race condition exists in the kfdcriucheckpointevents function where a mutex is not consistently held during event checkpointing. This allows a local attacker to cause memory corruption, potentially leading to privilege escalation...

RLSA-2026:57451 Moderate: cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS distribution but is now maintained independently. Security Fixes: libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PN...

GHSA-9X89-V382-MJH7 vulnerabilities

Vulnerabilities for packages: openssl...

EUVD-2026-63729

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

cowlib: Cowlib: Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding

A flaw was found in cowlib, an HTTP parser. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 frames containing oversized HPACK or QPACK prefixed integers. This unbounded decoding process leads to excessive memory allocation and...

The vulnerability of the file net/vmw_vsock/virtio_transport_common.c in Linux operating systems allows a hacker to trigger a service failure.

The vulnerability of the net/vmwvsock/virtiotransportcommon.c file in Linux operating systems is related to improper memory release. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-63495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in...

Linux Distros Unpatched Vulnerability : CVE-2026-77640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causi...

Linux Distros Unpatched Vulnerability : CVE-2026-63380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error pat...

Linux Distros Unpatched Vulnerability : CVE-2026-77641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUXSWITCH cell fails. The return value of relaysendcommandfromedge was ignored, so a...

Linux Distros Unpatched Vulnerability : CVE-2026-77639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream...

Oracle Business Intelligence Enterprise Edition (OAS 8.2) (August 2026 CSPU)

The version of Oracle Business Intelligence Enterprise Edition OAS 8.2.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API...

Oracle Business Intelligence Enterprise Edition (OAS 26.01) (August 2026 CSPU)

The version of Oracle Business Intelligence Enterprise Edition OAS 26.01.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API...