748 matches found
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013723)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013723 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: fix fhidg lifetime vs cdev The embedded struct cdev does not have its lifetime...
EUVD-2026-23965
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010795)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010795 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: fix fhidg lifetime vs cdev The embedded struct cdev does not have its lifetime...
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
A user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources...
Missing Release of Resource after Effective Lifetime
Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the DML component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network with high privileges. Remediation Upgrade libmysqlclie...
CVE-2026-33031
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an...
CVE-2026-33031
The CVE concerns Nginx UI prior to version 2.3.4 . A user disabled by an administrator can continue using previously issued API tokens for up to the token lifetime, allowing continued access to reading/modifying protected resources after disable. Tokens can create new accounts, so the disabled us...
Missing Release of Memory after Effective Lifetime
Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the ptpunpackSonyDPD function. An attacker can cause increased memory consumption and potential denial of service by repeatedly triggering property descriptor parsing that leads to...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007500)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007500 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: fix fhidg lifetime vs cdev The embedded struct cdev does not have its lifetime...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007513)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007513 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI: pnvphp: Clean up allocated IRQs on unplug When the root of a nested PCIe bridge configuratio...
CLSA-2026-1776173582 squid: Fix of 3 CVEs
CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries - CVE-2026-33515: ICP: fix validation of packet sizes and URLs - CVE-2026-33526: do not escape malformed URI twice when sending ICP errors...
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
Summary pyLoad caches role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old revoked privileges until logout/session...
Missing Release of Memory after Effective Lifetime
Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
Missing Release of Memory after Effective Lifetime
Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the PNG encoder when writing an MNG image. An attacker can cause resource exhaustion by repeatedly triggering failures during image encoding. Remediation A fix was pushed into the...
CLSA-2026-1776174481 squid: Fix of 3 CVEs
CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries - CVE-2026-33515: ICP: fix validation of packet sizes and URLs - CVE-2026-33526: do not escape malformed URI twice when sending ICP errors...
CLSA-2026-1776174115 squid: Fix of 3 CVEs
CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries - CVE-2026-33515: ICP: fix validation of packet sizes and URLs - CVE-2026-33526: do not escape malformed URI twice when sending ICP errors...
ROS-20260414-73-0046
Vulnerability in kernel-lt related to lack of memory release after effective lifetime. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
ROS-20260414-73-0023
Vulnerability in kernel-lt related to lack of memory release after effective lifetime. Exploitation of the vulnerability could allow an attacker to cause a denial of service...