Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099011)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099011 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache: fix write hang in passthrough mode The invalidateremove function has incomplete logic f...

CVE-2026-79661

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

EUVD-2026-65453

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79661

Ech0 (through 4.5.6) exposes the PUT /api/echo/like/:id endpoint on its public router group with no authentication and no rate limiting . An unauthenticated attacker can increment the fav_count counter of any echo—including private ones—by supplying its UUID, which is harvestable from the public ...

CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79661: Allocation of Resources Without Limits or Throttling

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

PT-2026-81280

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav count counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: The FPU state is invalidated after a failed XRSTOR operation from a user buffer. Both Intel and AMD consider it to be architecturally valid for XRSTOR to fail with PF, but they have nonetheless changed the state of the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit, 8c30b0018f9d “openrisc: Add jump label support”, copied from arm64 and did not properly account for how icache invalidation operates on remote cores in OpenRISC. On OpenRIS...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: KVM: arm64: nv: Translate VNCR again before injecting an abort. Vulnerabilities occur when KVM faults in the VNCR page with FOLLwrite whenever the guest aborts. This is similar to how a regular Stage-2 mapping is handled. It’s...

SUSE CVE-2026-72278

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

CVE-2026-56750

A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability ca...

GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution

In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...

BIT-DISTRIBUTION-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared dige...

PT-2026-77029

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

Linux Distros Unpatched Vulnerability : CVE-2026-72154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d openrisc: Add jump label support copies from arm64 and does not properly consider how icach...

Linux Distros Unpatched Vulnerability : CVE-2026-72278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with...

ANT-2026-61Y3NTY3 · suricata · Use-after-free

use-after-free high CVE-2026-45752 GHSA-qmc9-vqq2-8mv3 Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-61Y3NTY3:...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099762 advisory. In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de dm cache policy...