EulerOS Virtualization 2.12.0 : python-pillow (EulerOS-SA-2026-2797)

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that...

CVE-2026-64205

Summary: CVE-2026-64205 affects the Linux kernel i2c-i801 driver, where an unconditional hardware register cleanup in the error path could corrupt the SMBus hardware state machine during concurrent fuzzing, causing livelock and a Hung Task panic. Root cause: on i801_check_pre() failure (e.g., -EB...

CVE-2026-15588

CVE-2026-15588 affects GLib’s GDBus component. The gdbusauth mechanism fails to enforce length limits on data lines read from a client, enabling an unauthenticated attacker to trigger DoS and resource exhaustion by sending extremely long data streams. This can cause excessive memory and CPU consu...

.NET 10.0 security, bug fix, and enhancement update

10.0.110-1.0.1 - Add support for Oracle Linux 10.0.110-1 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 10.0.109-2 - Reduce time to detect hanging builds - Resolves: RHEL-191640...

Oracle Linux 9 : .NET / 9.0 (ELSA-2026-41896)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41896 advisory. 9.0.119-1.0.1 - Add support for Oracle Linux 9.0.119-1 - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192472 9.0.118-2 - Reduce time...

CVE-2026-64003

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEVDEL devices from scsirunhostqueues While a SCSI host is in a recovery state, scsimqrequeuecmd will not set the requeue list for a requeued command to be kicked in the future. The expectation...

EUVD-2026-45857

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h erratum 1235 Hygon Family 18h CPUs are derived from AMD Family 17h Zen1 silicon and share the same erratum 1235: hardware may read a stale IsRunning=1 bit during ICR...

CVE-2026-64003 scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEVDEL devices from scsirunhostqueues While a SCSI host is in a recovery state, scsimqrequeuecmd will not set the requeue list for a requeued command to be kicked in the future. The expectation...

EUVD-2026-45663

In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Reject FIP descriptors with zero fipdlen in CVL walker drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink advanced the descriptor cursor by an attacker-supplied fipdlen without ever requiring dlen = sizeofstruct fipde...

CVE-2026-53377 drm/msm: always recover the gpu

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

CVE-2026-53377

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

CVE-2026-53377

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

PT-2026-61207

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the FCoE Fibre Channel over Ethernet control VLAN walker where the fcoe ctlr recv clr vlink function in drivers/scsi/fcoe/fcoe ctlr.c fails to validate the length of F...

CVE-2026-53377: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

PT-2026-61082

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/msm component where the GPU recovery mechanism may fail to trigger. When no additional work is pending, the recover worker previously relied on the GPU enterin...

CVE-2026-64043: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix race between deleting interface and adding new peer While deleting an existing ovpn interface, there is a very narrow window where adding a new peer via netlink may cause the netdevice to hang and prevent its...

PT-2026-61360

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ovpn module during the deletion of an interface. A narrow window occurs during the ovpn dellink process where a CMD PEER NEW message sent via netlink to ad...

JLSEC-2026-760

A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection...

CVE-2026-45305

Summary of CVE-2026-45305 (Symfony YAML Parser ReDoS) Symfony’s YAML handling (Symfony\Component\Yaml\Parser::cleanup) can hang parsing crafted input due to the use of overlapping quantifiers in regular expressions for YAML directive, comment, and document marker cleanup. This is a client-side pa...

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Development Runner Telephony WebSocket /ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID SummaryThe pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without any authentication. An unauthenticated remote attacker who c...