CVE-2026-64513 KVM: x86: Unconditionally recompute CR8 intercept on PPR update

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

EUVD-2026-48965

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

Linux Distros Unpatched Vulnerability : CVE-2026-14257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option defau...

Linux Distros Unpatched Vulnerability : CVE-2026-64832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to...

PT-2026-64755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/hyperv component where a SYNTHVID RESOLUTION RESPONSE containing a resolution count greater than 64 causes the parse loop to read beyond the boundaries of the...

Linux Distros Unpatched Vulnerability : CVE-2026-64835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-47143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired and decode when disassembling...

EUVD-2026-48738

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 8.3.0...

CVE-2026-55730

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-12504

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-55728

Stack-based Buffer Overflow CWE-121 in /usr/bin/ltsudo cmdipaddrconflict in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly lo...

EUVD-2026-48590

Improper Privilege Management CWE-269 in /usr/bin/ltsudo in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to reset the password of any LARM user including the larmapp service account via the set-passwd...

CVE-2026-66009

Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 expose GraphQL validation error messages that reveal required custom input field names when public introspection is disabled (graphQLPublicIntrospection: false by default). A client with only the public applicat...

RHSA-2026:42877 Red Hat Security Advisory: java-1.8.0-openjdk security update

Bulletin has no description...

RHSA-2026:42876 Red Hat Security Advisory: java-1.8.0-openjdk security update

Bulletin has no description...

SUSE-SU-2026:22952-1 Security update for distribution

This update for distribution fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266629. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

[SECURITY] Fedora 44 Update: dotnet8.0-8.0.129-2.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...