kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns

A flaw was found in the Linux kernel's rtnetlink component. An unprivileged local user, leveraging a user namespace, can exploit a missing CAPNETADMIN capability check in the rtnlnewlink function. This allows the user to create paired network devices in arbitrary network namespaces, including the...

EUVD-2026-51418

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, UltimateVCAddons::uavclinkinit,...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:21455-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21455-1 advisory. This update for amazon-ecs-init fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 inp...

JLSEC-2026-1066 ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs...

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails: the method does not exit and continues to use memory that was already freed. This can be triggered during image processing and may lead to a denial of service...

CVE-2026-44106

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44093

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44106

CVE-2026-44106 describes a local privilege escalation in the init-script for user-applications (init.d /etc/init.d/user-applications). A low-privileged local user can run arbitrary commands as root, leading to full system compromise. The available documents provide CVSS v3.1/4.0 data (high severi...

EUVD-2026-51040

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44106 Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44093 Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a...

PT-2026-66434

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description A privilege escalation issue exists in the init-script for user-applications. This flaw allows a low-privileged local user to execute arbitrary commands with root...

OPENSUSE-SU-2026:21455-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128...

CVE-2026-64648

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INITFAILED before nvmetrequninit in digest error path In nvmettcptryrecvddgst, when a data digest mismatch is detected, nvmetrequninit is called unconditionally. However, if the command arrived via the...

CVE-2026-64534

The CVE-2026-64534 issue affects the Linux kernel nvmet-tcp path for NVMe over TCP. A data-digest mismatch could trigger an unconditional nvmet_req_uninit() cleanup, which, if the command arrived via the nvmet_tcp_handle_req_failure() path, results in a refcount underflow and a use-after-free tha...

CVE-2026-64222

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool-stack on AQ init failure otx2poolaqinit frees pool-stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2sqaurapoolinit unwinds the partial setup...

Siemens SIMATIC S7-1500 CPU 1518 MFP Divide By Zero (CVE-2025-39681)

In the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrlcpudetect in bspinit helper Since 923f3a2b48bd x86/resctrl: Query LLC monitoring properties once during boot resctrlcpudetect has been moved from common CPU initialization code to the...

UBUNTU-CVE-2026-64239

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regionsrmdirs DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region...