CVE-2026-94057

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing...

CVE-2026-93990

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and...

CVE-2026-94056

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...

CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-94057

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing...

CVE-2026-94057

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing...

CVE-2026-94056

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...

CVE-2026-94056

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...

CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free...

CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

GHSA-QP49-QGX5-5M26 vulnerabilities

Vulnerabilities for packages: apache-pulsar, spark, ruby4.0-bouncy-castle-java, ruby3.3-bouncy-castle-java, zipkin, opensearch, ruby3.4-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, kserve-modelmesh, keycloak...

CVE-2026-8763 vulnerabilities

Vulnerabilities for packages: apache-pulsar, spark, ruby4.0-bouncy-castle-java, ruby3.3-bouncy-castle-java, zipkin, opensearch, ruby3.4-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, kserve-modelmesh, keycloak...

GHSA-9PWP-9QQC-PR26 vulnerabilities

Vulnerabilities for packages: apache-pulsar, spark, ruby4.0-bouncy-castle-java, ruby3.3-bouncy-castle-java, zipkin, opensearch, ruby3.4-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, kserve-modelmesh, keycloak...

CVE-2026-13506 vulnerabilities

Vulnerabilities for packages: apache-pulsar, spark, ruby4.0-bouncy-castle-java, ruby3.3-bouncy-castle-java, zipkin, opensearch, ruby3.4-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, kserve-modelmesh, keycloak...

[SECURITY] [DLA 4788-1] linux-6.12 security update

Debian LTS Advisory DLA-4788-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings September 19, 2026 https://wiki.debian.org/LTS Package : linux-6.12 Version : 6.12.107-1deb12u1 CVE ID : CVE-2025-38525 CVE-2025-40054 CVE-2025-40074 CVE-2026-43197 CVE-2026-53092...

SUSE CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

SUSE CVE-2026-93493

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol OCSP response that omits the optional nextUpdate field. This omission causes the OCSP validation to be silently skipped, leading to...