CVE-2026-43082 net: txgbe: leave space for null terminators on property_entry

In the Linux kernel, the following vulnerability has been resolved: net: txgbe: leave space for null terminators on propertyentry Lists of struct propertyentry are supposed to be terminated with an empty property, this driver currently seems to be allocating exactly the amount of entry used. Chan...

CVE-2026-43077 crypto: algif_aead - Fix minimum RX size check for decryption

In the Linux kernel, the following vulnerability has been resolved: crypto: algifaead - Fix minimum RX size check for decryption The check for the minimum receive buffer size did not take the tag size into account during decryption. Fix this by adding the required extra length...

CVE-2025-71251

In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed...

CVE-2025-71252

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed...

PT-2026-37335

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed...

PT-2026-37512

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the iwlwifi driver regarding the parsing of SMEM Shared Memory in the 22000 series. An array overrun occurs when the firmware reports three LMACs Lower MAC addresses,...

CLSA-2026-1777974224 libwebp: Fix of 6 CVEs

CVE-2018-25009: fix out-of-bounds read in GetLE16 by validating VP8X chunk size - CVE-2018-25010: fix heap-based buffer overflow in ApplyFilter by limiting filter radius to image dimensions - CVE-2018-25011: fix heap-based buffer overflow in PutLE16 by rejecting multiple image chunks in ANMF...

curl: wcurl treats some URL operands after -- as curl options

I found that wcurl does not always keep operands after -- in a pure URL-data context. The documented way to pass curl options through wcurl is --curl-options, but a value supplied as a URL operand can still reach the final curl command as an option, for example wcurl -- "--url=file:///...". A...

WordPress Ocean Extra plugin <= 2.4.2 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Ocean Extra versions = 2.4.2...

CVE-2026-7034 Tenda FH1202 httpd WrlExtraSet stack-based overflow

A vulnerability was found in Tenda FH1202 1.2.0.14408. Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Performing a manipulation of the argument Go results in stack-based buffer overflow. The attack may be initiated remotely. The exploit...

EUVD-2026-25710

A vulnerability was found in Tenda FH1202 1.2.0.14408. Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Performing a manipulation of the argument Go results in stack-based buffer overflow. The attack may be initiated remotely. The exploit...

CVE-2026-41240

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not...

GHSA-H7MW-GPVR-XQ4M DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

There is an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214: / FORBIDATTR must always win, even if ADDATTR predicate would allow it / if FORBIDATTRlcName return false; The same fix was not...

BIT-AIRFLOW-2026-25917 Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly trusted, severity of this issue is Low. Users are recommended to upgrade to Apache Airflow 3.2.0,...

Security update 5.1.3 for Multi-Linux Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: Security issues fixed: CVE-2026-31958: Security patch for Salt vendored tornado: Added limits on multipart form data parsing bsc1259554 Added x8664v2 as a possible rpm package architecture Make users with backslash working for salt-ssh...

CVE-2026-25917

Apache Airflow CVE-2026-25917 involves API extra-links enabling crafted XCom payloads that can lead to webserver code execution via XCom deserialization/class instantiation. Affected component is the Airflow webserver’s handling of XCom; root cause described as deserialization/instantiation of pa...

[SECURITY] Fedora 44 Update: extra-cmake-modules-6.25.0-1.fc44

Additional modules for CMake build system needed by KDE Frameworks...

Malicious code in chai-extensions-extra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08c4557ac7891cf67170afbc45eeafdc6e59cede3471c194636ecd8d80e570d3 The package chai-extensions-extra was found to contain malicious code...

MAL-2026-2742 Malicious code in chai-extensions-extra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08c4557ac7891cf67170afbc45eeafdc6e59cede3471c194636ecd8d80e570d3 The package chai-extensions-extra was found to contain malicious code...

Fedora 44 : aurorae / bluedevil / breeze-gtk / extra-cmake-modules / etc (2026-fe3d8d4767)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-fe3d8d4767 advisory. Frameworks 6.25.0 + KDE Plasma 6.6.4 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...