Security update for postgresql17 (important)

openSUSE security update: security update for postgresql17 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20388-1 Rating: important References: bsc1258008 bsc1258009 bsc1258010 bsc1258011 bsc1258754 Cross-References: CVE-2026-2003 CVE-2026-2004...

Ext4 Heap Buffer Overflow DoS

The vulnerability of the ext4mbnormalizerequest function in the fs/ext4/mballoc.c module of the Ext4 file system support module in the Linux operating system is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability could allow a attacker t...

Ubuntu 16.04 LTS / 18.04 LTS : PJSIP vulnerabilities (USN-8122-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8122-1 advisory. Youngsung Kim discovered that PJSIP did not properly parse numeric header fields in SIP messages. A remote attacker could use this issue to...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the failure to remove automatically bound connected sockets from the 4-tuple hash table when they...

Sonarr 路径遍历漏洞

Sonarr is a software developed by Sonarr Corporation that helps with finding, downloading, and organizing television programs. Versions of Sonarr prior to 4.0.17.2950 contained a path traversal vulnerability. This vulnerability stemmed from the API not restricting file access to specific...

Linux ARM64 BPF JIT Heap Buffer Overflow DoS

The vulnerability of the bpfintjitcompile function in the arch/arm64/net/bpfjitcomp.c module, which is part of the networking support on the ARM 64-bit Linux operating system, involves executing operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker...

NFS Client Heap Buffer Overflow DoS

The vulnerability of the nfs4discovertrunking function in the fs/nfs/nfs4proc.c module, which is part of the NFS client support in Linux kernel, involves exposing confidential information. Exploiting this vulnerability could allow an attacker to cause service failures...

SUSE: Security Advisory (SUSE-SU-2026:0949-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-8098-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 9 : mysql:8.4 (ELSA-2026-5640)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-5640 advisory. mecab 0.996-3.4 - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: 2182069...

Fedora 44 : musescore (2026-390ce5262d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-390ce5262d advisory. Rebuilt with updated drwav to fix CVE-2026-29022. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

PT-2026-33102

Name of the Vulnerable Software and Affected Versions xwayland versions prior to 24.1.9-2.1 xorg-x11-server versions prior to 21.1.21-5.1 Description Security issues were identified in xwayland and xorg-x11-server. Recommendations Update xwayland to version 24.1.9-2.1. Update xorg-x11-server to...

CVE-2026-24157

creationtimestamp| type| source ---|---|--- 2026-03-24 22:01:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhtlaafs4h2t 2026-03-24 22:03:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhtlchdzrc2n 2026-03-31 03:20:09+00:00| seen|...

USN-8122-1 pjproject vulnerabilities

Youngsung Kim discovered that PJSIP did not properly parse numeric header fields in SIP messages. A remote attacker could use this issue to cause PJSIP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. CVE-2017-16872 Peter...

CVE-2025-33216

NVIDIA SNAP-4 Container contains a vulnerability in the configuration interface where an attacker on a VM may cause an incorrect calculation of buffer size by sending crafted configurations. A successful exploit of this vulnerability may lead to crash of the SNAP service, causing denial of servic...

CVE-2025-33215

NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending crafted messages. A successful exploit of this vulnerability may lead to a denial of service of the DPA and impact the availability of...

CVE-2025-33215

CVE-2025-33215 affects NVIDIA SNAP-4 Container, specifically a vulnerability in the VIRTIO-BLK component. A malicious guest VM can trigger an out-of-range pointer offset by sending crafted messages, potentially causing a denial of service and impacting storage availability for other VMs. The NVID...

CVE-2026-33417

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.2, password reset tokens in Wallos never expire. The passwordresets table includes a createdat timestamp column, but the token validation logic never checks it. A password reset token remains valid...

CVE-2026-33624

CVE-2026-33624 affects Parse Server. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who knows a user’s password and a valid MFA recovery code can reuse that code indefinitely by sending concurrent login requests, defeating the single‑use design of recovery codes. Impacted component: MFA...

CVE-2026-33400

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, a stored cross-site scripting XSS vulnerability in the payment method rename endpoint allows any authenticated user to inject arbitrary JavaScript that executes when any user visits the Settings,...