CVE-2026-80574 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

CVE-2026-80558

This Linux kernel vulnerability affects the libceph subsystem. A corrupted osdmap received from a Ceph monitor or OSD may contain OSD indices in its primary_temp field that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). While most OSD indices in the osdmap are validated, the one...

CVE-2026-80552 s390/vfio_ccw: Ensure index for read/write regions are within range

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

CVE-2026-80552

CVE-2026-80552 affects the Linux kernel on s390 architectures, specifically the vfio_ccw driver. When the capability chain was introduced, it correctly clamped region indexes to the capability range but neglected to apply the same bounds check to existing read/write regions , allowing out-of-rang...

CVE-2026-80552 s390/vfio_ccw: Ensure index for read/write regions are within range

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing...

CVE-2026-74742 veth: fix queue index used to wake the peer txq in veth_poll

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in vethpoll vethpoll derives the index of the peer TX queue to wake from rq-xdprxq.queueindex. That field is only initialized by xdprxqinforeg in vethenablexdprange, which runs only...

CVE-2026-80346 StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

Linux Distros Unpatched Vulnerability : CVE-2026-80552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfioccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of t...

PT-2026-82168

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/vfio ccw component where the system failed to properly clamp the index for read/write regions to the range of the capabilities. While the capability chain...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098834)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098834 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TC...

PT-2026-82174

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph module where a corrupted osdmap received from a Ceph monitor or OSD may contain invalid osd indices in its pg temp, primary temp, pg upmap, and pg upmap...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104768)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104768 advisory. Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, v...

AZL-97634 CVE-2026-61555 affecting package OpenEXR 2.3.0-6

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...

CVE-2026-61555

OpenEXR (the reference implementation for the EXR image format used in the motion picture industry) is vulnerable to a crash when Imf::GetChannelsInMultiPartFile() processes a crafted EXR file with an empty multiView header attribute. The root cause is that Imf::viewFromChannelName() indexes an e...

CVE-2026-61555

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...

CVE-2026-78682 NLTK before 3.10.3 SSRF Protection Bypass via Proxy

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113

CRI-O is vulnerable in its container-creation environment-variable handling (mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/container_create.go). When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to the target OCI image's confi...

CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...