PT-2026-83074

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.5-1.1 Description An authentication flaw exists where a token intended for a different purpose can be used to authenticate. This occurs when an OAuth2 token response lacks a scope claim, causing the system to use...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098773)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098773 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098987)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098987 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x-tunnel as we delete x The ipcomp fallback tunnels currently get deleted from the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098722)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098722 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6vti: set netnsimmutable on the fallback device. john1988 and Noam Rathaus reported that...

EUVD-2026-65344

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

BIT-CONTOUR-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: imx: Reconfigure for PIO when DMA cannot be started When spiimxcandma selects DMA, the ECSPI is configured for DMA. spiimxsetupxfer sets CTRL.SMC and clears dynamicburst, and spiimxdmatransfer programs the dynamic-burst...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fixed page mapping when vmareaallocpages uses high-order fallback to order 0. The vmappagesrangenoflush function assumes that its argument pages contains pages with the same page shift. However, since commit...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: gpu/buddy: Abandon the tryharder attempt when alignment cannot be respected. The tryharder contiguous fallback might return a range whose start offset does not match the caller’s minblocksize. When a candidate’s start is...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec – fixed the aead software fallback for the engine. Due to the misuse of the subreq pointer, private context memory was affected. The aead software-related crypto function occasionally causes the operating...

CVE-2026-74664 net: openvswitch: reallocate update replies for mismatched IDs

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318

CVE-2026-59318 is an Incorrect Authorization flaw in Spring AI 's tool calling support, specifically in DefaultToolCallingManager within the org.springframework.ai:spring-ai-model package. The per-request tool list is advertised to the model as a boundary but is not fully enforced at dispatch tim...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102067)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102067 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create a...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102024)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102024 advisory. In the Linux kernel, the following vulnerability has been resolved: ip6vti: set netnsimmutable on the fallback device. john1988 and Noam Rathaus reported that...

EUVD-2026-63653

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations i...

CVE-2026-70651

In libvips versions before 8.18.3, the ImageMagick fallback path in magick6load.c and magick7load.c multiplies per-page Ysize by n_frames without bounds checking, causing a heap buffer over-read and crash when loading a crafted multi-page TIFF. CVSS 6.9 (medium), local attack vector. Fixed in 8.1...

UBUNTU-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595

Netty (asynchronous, event-driven network framework) is affected by an SNI routing bypass in io.netty.handler.ssl.SslClientHelloHandler#decode . The method checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records triggers an ...