CVE-2026-80971: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

CVE-2026-89241: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...

CVE-2026-89332: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

CVE-2026-89625: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghlpoketimer / ghlurb at driver unbind For GHL Guitar Hero Live dongles, sonyprobe arms a periodic timer: ghlmagicpoke the timer callback submits sc-ghlurb, and the URB completion ghlmagicpokecb re-arms the...

CVE-2026-89656: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

CVE-2026-89673: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the subsequent xdrencodeopaque calls emit 8 + roundupnetidlen, 4 +...

CVE-2026-89674: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

CVE-2026-80932: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...

CVE-2026-80996: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

CVE-2026-89746: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as nameddata. Both are added to tr-histvars by savehistvars...

CVE-2026-89611: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

CVE-2026-89758: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

The vulnerabilities of MIH, MPEG DSM-CC, eDonkey, and MEGACO traffic analyzer Wireshark allow attackers to induce service failures.

The vulnerability of MIH, MPEG DSM-CC, eDonkey, and MEGACO protocol decoders, as well as the Wireshark traffic analyzer, is related to the execution of a cycle with an unavailable exit condition. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the EncryptInterceptor component of the Apache Tomcat application server allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the EncryptInterceptor component in the Apache Tomcat application server is related to insufficient technical documentation. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107271)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107271 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4xattrinodedecrefall' we should ignore xattrs entrie...

RHEL 9 : nginx (RHSA-2026:66542)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66542 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-89161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. CVE-2026-89161...

Linux Distros Unpatched Vulnerability : CVE-2026-89162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PCRE2 before 10.48, pcre2serializeencode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is...

MiracleLinux 9 : opentelemetry-collector-0.152.1-2.el9_8 (AXSA:2026-1812:05)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1812:05 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service...