CVE-2026-24843

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries...

x86: buffer overrun with shadow paging + tracing

ISSUE DESCRIPTION Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing. IMPAC...

MiracleLinux 8 : open-vm-tools-12.3.5-2.el8_10.2 (AXBA:2026-083:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2026-083:01 advisory. - VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files...

Nextcloud: View-only guests could see deleted Collectives pages in the trashbin

A vulnerability was discovered where view-only guests could see deleted Collectives pages in the trashbin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001091)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001091 advisory. The xenbiovecphysmergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000834)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000834 advisory. The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001065)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001065 advisory. Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000835)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000835 advisory. arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004308)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004308 advisory. An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions o...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000962)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000962 advisory. The xenfailsafecallback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002155)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002155 advisory. The xenfailsafecallback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001782)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001782 advisory. Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002191)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002191 advisory. The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002539)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002539 advisory. arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which makes it easier for attackers to conduct Spectre-v2 attacks...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002984)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002984 advisory. Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002690)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002690 advisory. The accesspmuevcntr function in arch/arm64/kvm/sysregs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause a denial of service assertio...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002785)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002785 advisory. kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's K...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002567)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002567 advisory. The handleinvept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service NULL pointer...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003273)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003273 advisory. The switchto function in arch/x86/kernel/process64.c in the Linux kernel does not properly context- switch IOPL on 64-bit PV Xen guests, which allows local guest OS...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002432)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002432 advisory. Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a...