CVE-2026-46917

...

CVE-2026-21954

CVE-2026-21954 affects Oracle Retail Xstore Point of Service (Xstore Mobile), affected in version 21.0.3. A low-privileged, network-access attacker (via HTTP) can cause unauthorized read access to a subset of Xstore POS data. CVSSv3.1 base score 4.3 (Confidentiality). The Oracle July 2026 Critica...

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425

Summary: CVE-2026-47425 affects rattler before 0.43.2, enabling a noarch:python entry-point path traversal that can write files outside the intended install prefix. The issue arises in EntryPoint::FromStr within rattler_conda_types, where only .trim() is applied to the command and a malicious noa...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

CVE-2026-63913

A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP Transmission Control Protocol packets, specifically a SYN synchronize packet followed by an RST reset packet with an invali...

EUVD-2026-46300

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

MINI-J622-WFVX-PVMR

Bulletin has no description...

MINI-MFVF-VW4W-JWWQ

Bulletin has no description...

MINI-X333-GF5X-9WJ3

Bulletin has no description...

MINI-XF82-4WXR-PCVR

Bulletin has no description...

MINI-4VQV-3Q85-GG66

Bulletin has no description...

SUSE CVE-2026-53374

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpubocreatekernel does not zero-initialize the buffer, when a single PTE is written the TLB may speculativel...

SUSE CVE-2026-63885

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

SUSE CVE-2026-63893

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tbpropertyentryvalid entry-value is u32 and entry-length is u16; the sum is performed in u32 and wraps. A malicious XDomain peer can pick value = 0xffffff00, length = 0x100 so the sum...

SUSE CVE-2026-64067

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream-subrequests locklessly The list of subrequests attached to stream-subrequests is accessed without locks by netfscollectreadresults and netfscollectwriteresults, and then they acce...

SUSE CVE-2026-64106

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

MINI-XQ76-772H-V9PC

Bulletin has no description...

CVE-2026-63817

A flaw was found in the Linux kernel's F2FS file system. When the compresscache mount option is disabled, a corrupted directory entry could point to an invalid inode number. The system incorrectly processes this as a valid internal inode, bypassing critical validation checks. This vulnerability...