CVE-2026-64040

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfsmkdir fails When vfsmkdir fails, the error code is not extracted from the returned error pointer. This causes mkdirerror to be reached with ret=0, which leads to returning ERRPTR0 NULL instead...

PT-2026-61357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cachefiles module where the system fails to correctly extract the error code when the vfs mkdir function fails. This results in the mkdir error logic being trigger...

EUVD-2026-44662

A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for system accounts can...

openSUSE 16 Security Update : xwayland (openSUSE-SU-2026:21283-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21283-1 advisory. This update for xwayland fixes the following issues - CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer overflow...

openSUSE 16: xorg-x11-server / xorg-x11-server-Xvfb / xorg-x11-server-extra / etc (openSUSE-SU-2026:21273-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21273-1 advisory. This update for xorg-x11-server fixes the following issues - CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer...

xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()

...

CVE-2026-56000

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent pointing into potentially reallocated memory...

CVE-2026-56000

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent pointing into potentially reallocated memory...

CVE-2026-56000 xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()

Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent pointing into potentially reallocated memory...

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer overflow when a font loaded from a malicious PCF file is processed bsc1268893. CVE-2026-56000: improper memory management in CommonMakeCurrent can lead to a...

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues CVE-2026-55999: missing bounds check in glamorfontget can lead to a heap buffer overflow when a font loaded from a malicious PCF file is processed bsc1268893. CVE-2026-56000: improper memory management in CommonMakeCurrent can lead to a...

PT-2026-56335

Name of the Vulnerable Software and Affected Versions xorg-server versions prior to 21.2.24 xwayland versions prior to 24.1.13 Description Local attackers with an X connection can cause a Heap Use After Free, a condition where the system continues to use a memory address after it has been freed,...

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the makelabel function in the reduce method. An attacker can execute arbitrary commands by crafting...

EUVD-2025-210411

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.makelabel function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but executes arbitrary commands when pickle.load is called...

GHSA-J9WQ-VXXC-94WF Hackney has CR/LF injection in query parameter

Summary hackneyurl:makeurl/3 passes the URL query component directly into the HTTP/1.1 request target without percent-encoding \r or \n. RFC 3986 §3.4 requires characters outside the query grammar to be percent-encoded, but no validation or escaping occurs. An attacker who controls any portion of...

PT-2026-51329

Name of the Vulnerable Software and Affected Versions keras-team/keras version 3.14.0 Description A path traversal issue exists in the Keras 3 model saving and loading library. The DiskIOStore.make function fails to sanitize user-provided layer names for parent directory components .. when...

Important: perl-GD

Issue Overview: command injection via 2-arg open in makefilehandle CVE-2026-11526 Affected Packages: perl-GD Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization in the authorization process for public assets. An attacker can perform unauthorized actions such as creating, updating, reapplying, and deleting VEX rules, as well as making changes to vulnerability-triage...

CVE-2026-48089 DevGuard has improper authorization on public assets

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

CVE-2017-20279

Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the aid parameter. Attackers can send GET requests to index.php with malicious aid values in the makepayment task to extract sensitive...