SUSE CVE-2026-64730

The issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Visiting a website that frames malicious content may lead to UI spoofing...

Linux Distros Unpatched Vulnerability : CVE-2026-63495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in...

CVE-2026-74558

A flaw was found in the Linux kernel's zero-copy ZC transmit Tx batch path. When processing network packets, the system can fail to properly reclaim memory UMEM frames if it encounters invalid or oversized packet descriptors. This can lead to resource exhaustion, where memory is not returned to...

CVE-2026-74368

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. When processing Wi-Fi frames, an invalid NWIFI Network Wi-Fi header length during TKIP Temporal Key Integrity Protocol MIC Message Integrity Code verification can cause an early exit from a handling function. This prevents the associated...

CVE-2026-63495

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-63495 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-63495 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-63495 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-63495

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-74322

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This vulnerability allows an attacker to trigger an invalid memory access when processing specific Wi-Fi frames. This can lead to a system crash, resulting in a Denial of Service DoS for affected systems...

USN-8654-1 netty vulnerabilities

It was discovered that Netty did not properly handle malformed HTTP/2 control frames. An attacker could use this to cause a denial of service via resource exhaustion. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. CVE-2025-55163 It was discover...

USN-8654-1: Netty vulnerabilities

It was discovered that Netty did not properly handle malformed HTTP/2 control frames. An attacker could use this to cause a denial of service via resource exhaustion. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. CVE-2025-55163 It was discover...

CVE-2026-74488

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When parsing Tunneled Direct Link Setup TDLS frames within an Aggregated MAC Service Data Unit A-MSDU, the driver incorrectly uses the length of the parent frame instead of the subframe. This error can lead to a use-after-free...

CVE-2026-24184: Buffer Copy without Checking Size of Input

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol LLDP daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution...

CVE-2026-74978: Improper Restriction of Rendered UI Layers or Frames

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74951: Improper Restriction of Rendered UI Layers or Frames

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-18534: Improper Restriction of Rendered UI Layers or Frames

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

Linux Distros Unpatched Vulnerability : CVE-2026-74322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif =...

CVE-2026-72119

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcast Manager BCM module. This vulnerability arises from a race condition where CAN frame data and timer updates can be observed in a partially updated or unvalidated state due to insufficient locking. Additionally, a missing...

CVE-2026-59881

A flaw was found in AIOHTTP. The WebSocket client in AIOHTTP processes compressed data frames even when the compression mechanism, known as permessage-deflate, has not been properly negotiated. A malicious server can exploit this by sending specially crafted compressed frames. This can lead to...