About the security content of Safari 26.6

About the security content of Safari 26.6 This document describes the security content of Safari 26.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

DEBIAN-CVE-2026-15578

Bulletin has no description...

DEBIAN-CVE-2026-61475

Bulletin has no description...

CVE-2026-17459 perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possib...

EUVD-2026-49054

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possib...

CVE-2026-17434

A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...

PT-2026-64810

Name of the Vulnerable Software and Affected Versions perwendel spark versions prior to 2.9.5 Description A flaw in the SparkJava component allows remote attackers to trigger symlink following. This occurs within the staticFiles.externalLocation function located in the...

MINI-5JP4-34MF-JMJX

Bulletin has no description...

MINI-RM5F-RC9V-QRP2

Bulletin has no description...

MINI-X9J5-JH9P-J9V4

Bulletin has no description...

SUSE CVE-2026-64457

In the Linux kernel, the following vulnerability has been resolved: virtiopci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 /sys/bus/virtio/drivers/virtioballoon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer...

Improper Authentication

Jetty HTTP Client is vulnerable to Improper Authentication. The vulnerability is due to the use of ISO-8859-1 encoding when computing Digest authentication response hashes, which replaces all non-Latin-1 characters with ?, allowing an attacker who knows a victim's username to bypass Digest...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

DEBIAN-CVE-2026-64518

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcpaoestablishedkey. lockdepsockisheld was added in tcpaoestablishedkey by the cited commit. It can be called from tcpv46timewaitack with twsk. Since it does not have sk-sklock, the lockd...

DEBIAN-CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

DEBIAN-CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

DEBIAN-CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

CVE-2026-64521

In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pins sysfs node may deadlock. pinconfpinsshow holds pctldev-mutex, and the platform driver calls pinctrlfindgpiorangefrompin, which tries to acquire the same...

DEBIAN-CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

DEBIAN-CVE-2026-64499

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...