kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

A flaw was found in the Linux kernel, specifically within the RDMA Remote Direct Memory Access vmwpvrdma module. This vulnerability is a double free, which means the system attempts to release the same memory resource twice. This can occur in an error handling path within the pvrdmaallocucontext...

CVE-2026-58266: Origin Validation Error

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and edito...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path CVE-2026-53366...

Medium: containerd

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Linux Distros Unpatched Vulnerability : CVE-2026-53763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology...

CVE-2026-59153: Origin Validation Error

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...

ROS-20260707-73-0023

The vulnerability of the sshrsakexfreekey function in the PuTTY cryptographic protection tool is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to cause a service failure remotely...

ROS-20260707-73-0018

The vulnerability in freerdp3 is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-56185

Name of the Vulnerable Software and Affected Versions Zephyr version 4.4.0 Description The Dhara flash translation layer disk driver in drivers/disk/ftl dhara.c contains a flaw where dhara nand callbacks write error codes unconditionally to a caller-supplied dhara error t err pointer. During the...

Medium: nerdctl

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

PT-2026-67270

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description A heap out-of-bounds read occurs in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types that have insufficient ExtraData. A remote attacker can trigger a crash by sending malformed...

PT-2026-72507

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipvs component where inner IP headers in ICMP errors from tunnels may not be correctly placed in the skb headroom after outer headers are stripped using the pskb...

Low: gnupg2

Issue Overview: CMS Cryptographic Message Syntax parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. CVE-2026-57062 Affected Packages: gnupg2 Issue Correction...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

CVE-2026-38976

mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in opsuper / OPSUPER due to a missing runtime guard for top-level super...

GHSA-PMF6-RCX4-V53V mkfifo: permissions of an existing file are changed after FIFO creation fails

When mkfifo fails e.g. target already exists, the code shows an error but is missing a continue;, so it falls through to fs::setpermissions and changes the permissions of the pre-existing file to the default FIFO mode 0o666 & umask - 0644. $ touch secret; chmod 000 secret $ coreutils mkfifo secre...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the CORS origin validation process. An attacker can gain unauthorized access to sensitive data by crafting a subdomain that encodes their own workspace UUID and a victim's username, then tricking an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the CORS origin validation process. An attacker can gain unauthorized access to sensitive data by crafting a subdomain that encodes their own workspace UUID and a victim's username, then tricking an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the CORS origin validation process. An attacker can gain unauthorized access to sensitive data by crafting a subdomain that encodes their own workspace UUID and a victim's username, then tricking an...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the CORS origin validation process. An attacker can gain unauthorized access to sensitive data by crafting a subdomain that encodes their own workspace UUID and a victim's username, then tricking an...