DEBIAN-CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-89862 scsi: qla2xxx: Fix BSG job leak on validate flash image error path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-89862 scsi: qla2xxx: Fix BSG job leak on validate flash image error path

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

PT-2026-93714

Name of the Vulnerable Software and Affected Versions ag-ui-protocol ag-ui version 1.0 Description A weakness in the Event Application Layer component allows remote exploitation. The issue occurs within the prepareRunAgentInput function located in the agent/agent.ts file, where manipulation of th...

CVE-2026-89862: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix BSG job leak on validate flash image error path qla28xxvalidateflashimage returns QLASUCCESS 0 unconditionally, telling the FC BSG transport fcbsghostdispatch that the driver owns and will complete the request...

CVE-2026-73443: Authentication Bypass by Capture-replay

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

CVE-2026-73444

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header IP-AH authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the...

CVE-2026-87195

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Hyperion Financial...

EUVD-2026-78824

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

grafana: Grafana: Arbitrary code execution and information disclosure via Cross-Site Scripting in geomap panel

A flaw was found in the Grafana geomap panel's XYZ tile layer. An attacker with editor privileges can exploit a sanitize-then-interpolate ordering bug by setting a textbox variable's default value to a Cross-Site Scripting XSS payload. This payload executes for every user who opens the dashboard,...

SUSE CVE-2026-90622

A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: s390/qeth: Fixed a kernel panic that occurred after setting the hsuid attribute. Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device, while the corresponding network interface is already up, the...

Astra Linux – Vulnerability in libsdl1.2, libsdl2

The SDL Simple DirectMediaLayer versions from 1.2.15 up to 2.x, and from 2.0.9 up to 2.0.9, have a buffer over-reading issue in the IMAADPCMnibble function in the audio/SDLwave.c file...

Astra Linux – Vulnerability in libsdl1.2

It was discovered that SDL v1.2 contains a use-after-free issue due to the XFree function in the file /src/video/x11/SDLx11yuv.c...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In TLS communication, there was an issue where we took a reference to psock after locking the RX lock, in order to avoid leaks. At the beginning of the tlsswrecvmsg function, we take a reference to psock, and then call...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: tls: fixed the missing memory barrier in tlsinit In tlsinit, a write memory barrier is missing, and store-store reordering may cause NULL dereferencing in tlssetsockopt,getsockopt. CPU0 CPU1 ----- ----- // In tlsinit // In...

Astra Linux – Vulnerability in Chromium

Out-of-bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fastrx entry still holds a pointer to the VLAN’s netdev. This can lead to use-after-free...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tls: Stop recv if the initial processrxlist contains a record that is not of the DATA type. If there is a record on rxlist that is not of the DATA type, and there is another record of the same type still in the queue, we will mer...