UBUNTU-CVE-2026-89887

In the Linux kernel, the following vulnerability has been resolved: m...

UBUNTU-CVE-2026-89862

In the Linux kernel, the following vulnerability has been resolved: s...

OPENSUSE-SU-2026:11803-1 alloy-1.19.2-1.1 on GA media

These are all security issues fixed in the alloy-1.19.2-1.1 package on the GA media of openSUSE Tumbleweed...

UBUNTU-CVE-2026-89915

In the Linux kernel, the following vulnerability has been resolved: K...

UBUNTU-CVE-2026-89992

In the Linux kernel, the following vulnerability has been resolved: c...

UBUNTU-CVE-2026-89837

In the Linux kernel, the following vulnerability has been resolved: f...

UBUNTU-CVE-2026-89860

In the Linux kernel, the following vulnerability has been resolved: s...

UBUNTU-CVE-2026-89801

In the Linux kernel, the following vulnerability has been resolved: d...

UBUNTU-CVE-2026-89916

In the Linux kernel, the following vulnerability has been resolved: K...

Linux Distros Unpatched Vulnerability : CVE-2026-75516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start...

MAL-2026-16245 Malicious code in kartyk-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc583cefb03bc649c96d2e8b48cc2bd5d73d8f6c489ded9b46c217ba1f212ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2026-1789598338 TuxCare security update for 6 packages (7 CVEs)

TuxCare rebuilt 6 packages to address 7 CVEs. Fixed in 4.0.3-tuxcare.7...

CLSA-2026-1789597929 TuxCare security update for @remix-run/router (1 CVE)

TuxCare rebuilt @remix-run/router to address 1 CVE. Fixed in 1.23.0-tuxcare.3...

CLSA-2026-1789597571 TuxCare security update for elliptic (1 CVE)

TuxCare rebuilt elliptic to address 1 CVE. Fixed in 6.6.0-tuxcare.2...

DEBIAN-CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

GHSA-C67V-VQRP-M5WJ djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

Impact For views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view...

GHSA-F795-P5JW-J6G2 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

Impact SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns or a victim who leaks a sessionid could connect to the message endpoint and dispatch event...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92588 n8n before 1.123.76 Improper Authorization via Source Control Push

n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting...

CVE-2026-92586 AVideo through 29.0 Missing Authorization via comment API endpoint

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...