PT-2026-98139

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gfs2 module where the qc++ iterator increment was located within the loop body of the gfs2 quota init function. This placement caused pointer advancement to be mix...

PT-2026-97939

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A circular locking dependency exists in the OCFS2 file system within the ocfs2 init acl function. The issue occurs between the &oi-ip xattr sem and &journal-j trans barrier locks. A...

Oracle Linux 8 : postgresql:12 (ELSA-2026-69924)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69924 advisory. - Add backport of CVE-2025-8714 Orabug: 38667546 - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-14670...

Linux Distros Unpatched Vulnerability : CVE-2026-97521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gfs2: fix quota init duplicate scan gfs2quotainit checks for duplicate quotachange IDs while holding qdlock and the quota hash bucket bitlock. That path used...

PT-2026-98140

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gfs2 module where the gfs2 quota init function checks for duplicate quota change IDs while holding the qd lock and the quota hash bucket bitlock. This process...

PT-2026-97953

In the Linux kernel, the following vulnerability has been resolved: arm64: RSI: fix field-spanning write warning in attestation token init The challenge is passed in registers a1 through a8. However, copying to &regs.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a...

SUSE CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

DEBIAN-CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

EUVD-2026-85343

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

The Flatpak tool is vulnerable to an arbitrary write in the host context via the flatpak build-init --writable-sdk --sdk-extension command. A malicious SDK container can declare an extension point with a crafted directory path containing .. traversal sequences. Because the target path is resolved...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276: Improper Limitation of a Pathname to a Restricted Directory

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

postgresql:12 security update

12.22-10.0.1 - Add backport of CVE-2025-8714 Orabug: 38667546 12.22-10 - Backport fixes for multiple CVEs - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-14679 - Resolves: CVE-2026-14680, CVE-2026-1574...

Linux Distros Unpatched Vulnerability : CVE-2026-96276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension...

PT-2026-97348

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A flaw exists where a malicious SDK container can trigger arbitrary file writes on the host system. This occurs when a developer executes the command flatpak build-init --writable-sdk...