CVE-2026-56128: Improper Neutralization of Input During Web Page Generation

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

PT-2026-85068

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description A double free occurs in the OpenSSL-based TLS certificate revocation checking path. This issue is triggered during the handshake process when a TLS endpoint trusted by the client sen...

Linux Bluetooth Buffer Overflow DoS

The vulnerability of the btsdioremove function in the drivers/bluetooth/btsdio.c driver for Bluetooth devices in Linux operating systems is related to the repeated release of previously released memory. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2026-33630: Double Free

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: smc: Fix use-after-free in pnetfindbasendev CVE-2025-40064 kernel: Linux kernel: Denial of Service due to memory leak in tpm2loadcmd CVE-2025-71147 kernel: bonding: alb: fix UAF in...

openssl: Double-free When Checking OCSP Stapled Response

A flaw was found in OpenSSL. A malicious server can exploit the TLS Online Certificate Status Protocol OCSP stapling feature by sending a specially crafted response. This can trigger a double-free vulnerability in the client's certificate verification process, potentially leading to a Denial of...

MGASA-2026-0369 Updated libalsa2 packages fix security vulnerabilities

alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow. CVE-2026-25068 ALSA Library 1.2.16.1 Double-Free via parsedef in conf.c. CVE-2026-56109...

MGASA-2026-0367 Updated perl-YAML-Syck packages fix security vulnerabilities

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec YAML::Syck versions before 1.47...

Updated libalsa2 packages fix security vulnerabilities

alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow. CVE-2026-25068 ALSA Library 1.2.16.1 Double-Free via parsedef in conf.c. CVE-2026-56109...

Updated libarchive packages fix security vulnerabilities

Double-free vulnerability in rar5 decompression logic via dangling filteredbuf pointer in initunpack. CVE-2026-14164 Heap overflow oob read while parsing a tar archive contains a pax extended header. CVE-2026-15028 A null pointer dereference vulnerability exists in the acl parser of libarchive...

Updated perl-YAML-Syck packages fix security vulnerabilities

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec YAML::Syck versions before 1.47...

MGASA-2026-0366 Updated libarchive packages fix security vulnerabilities

Double-free vulnerability in rar5 decompression logic via dangling filteredbuf pointer in initunpack. CVE-2026-14164 Heap overflow oob read while parsing a tar archive contains a pax extended header. CVE-2026-15028 A null pointer dereference vulnerability exists in the acl parser of libarchive...

SUSE-SU-2026:23463-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: August 2026 release. - CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue bsc1274791. - CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate bsc1274792. - CVE-2026-18798: QUI...

OPENSUSE-SU-2026:21744-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: August 2026 release. - CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue bsc1274791. - CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate bsc1274792. - CVE-2026-18798: QUI...

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

EUVD-2026-64763

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding...

Use-after-free in `clear` and `retain` when an element's `Drop` panics

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero. back, backmut, lastkeyvalue and last dereference tail through...

RUSTSEC-2026-0300 Use-after-free in `clear` and `retain` when an element's `Drop` panics

SkipList::clear drops the node chain and only then resets tail and len. The drop runs each element's Drop, and T carries no bounds excluding a panicking one. If it unwinds, tail still points at the freed node while len stays non-zero. back, backmut, lastkeyvalue and last dereference tail through...

SUSE CVE-2026-72361

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hwengine: Fix double-free of managed BO in error path The error path in hwengineinit explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup action...

SUSE CVE-2026-72405

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: prevent double queueing in udptunnelnicdevicesync Yue Sun reported a use-after-free and debugobjects warning in udptunnelnicdevicesyncwork during concurrent device operations. The workqueue core clears the interna...