vsock/vmci: fix sk_ack_backlog leak on failed handshake

...

net/sched: act_api: use RCU with deferred freeing for action lifecycle

...

drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

...

batman-adv: v: stop OGMv2 on disabled interface

...

[SECURITY] Fedora 44 Update: python-postorius-1.3.13-1.fc44

The Postorius Django app provides a web user interface to access GNU Mailman...

[SECURITY] Fedora 43 Update: python-postorius-1.3.13-1.fc43

The Postorius Django app provides a web user interface to access GNU Mailman...

EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-2472)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob function on...

EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-2513)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob function on...

EUVD-2026-38068

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host...

CVE-2026-55975

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the StorageInterface.parentTraversalGuard function. An attacker can access arbitrary files on the host filesystem by submitting a specially crafted kestra:// URI containing URL-encoded directory traversal...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the web UI handlers responsible for managing hosts and networks. An attacker can gain unauthorized access to sensitive information and perform destructive actions across resources owned by other operators by...

GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...

GHSA-F65R-H4G3-3H9H Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Summary In backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: falcoctl, spire-server, falcoctl-fips, ratify, ko-fips, policy-controller-fips, docker-fips, kubescape-server, kubescape, kyverno, crossplane, cloudbeat-fips, tekton-chains, trivy-operator-fips, tekton-chains-fips, tbot, zarf, chainctl-fips, policy-controller,...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: falcoctl, spire-server, falcoctl-fips, ratify, ko-fips, policy-controller-fips, docker-fips, kubescape-server, kubescape, kyverno, crossplane, cloudbeat-fips, tekton-chains, trivy-operator-fips, tekton-chains-fips, tbot, zarf, chainctl-fips, policy-controller,...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: tflint, zarf, tekton-chains, ratify, goreleaser, ko, neuvector-sigstore-interface, teleport, trivy-operator, aactl, falcoctl, tkn, kyverno-notation-aws, kyverno, slsa-verifier, gitsign, kubescape, spire-server, crossplane, policy-controller...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: tflint, zarf, tekton-chains, ratify, goreleaser, ko, neuvector-sigstore-interface, teleport, trivy-operator, aactl, falcoctl, tkn, kyverno-notation-aws, kyverno, slsa-verifier, gitsign, kubescape, spire-server, crossplane, policy-controller...

CVE-2026-53317

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: Place upper limit on station AID Any station configured with an AID over 20 causes a firmware crash. This situation occurred in our testing using an AP interface on 7922 hardware, with a modified hostapd,...

CVE-2026-53303

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extensionlist reading with sblock in f2fssbishow In f2fssbishow, the extensionlist, extensioncount and hotextcount are read without holding sbi-sblock. If a concurrent sysfs store modifies the extension list via...