CVE-2026-63962

The CVE-2026-63962 entry describes a Linux kernel vulnerability in usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes(). The root cause is that svdm_consume_modes() checked pmdata->altmodes against the array size only once before looping over the count, not at every ite...

CVE-2026-63884 drm/i915: Fix potential UAF in TTM object purge

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

CVE-2026-63863 drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...

CVE-2026-63863

The CVE-2026-63863 entry concerns the Linux kernel drm/gpusvm subsystem. The issue is a unbalanced unlock of gpusvm notifier_lock detected during drm_gpusvm_scan_mm(), where a path under err_free calls drm_gpusvm_notifier_lock() after unlocking, leading to a bad unlock balance warning. Connected ...

CVE-2026-53377

CVE-2026-53377 affects the Linux kernel DRM MSM driver. The GPU recovery path (Recover_worker) could fail to trigger recovery when no new work is submitted, leaving the GPU hung and potentially causing timeouts or unavailability. The fix changes Recover_worker to always recover the GPU (increment...

CVE-2026-53377 drm/msm: always recover the gpu

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

CVE-2026-53377

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

EUVD-2026-45430

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...

CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...

CVE-2026-16219 Croogo CMS Admin File Manager FileManager.php isEditable path traversal

A flaw has been found in Croogo CMS up to 4.0.7. This affects the function FileManager::isEditable of the file FileManager/src/Utility/FileManager.php of the component Admin File Manager. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published...

CVE-2026-16219

CVE-2026-16219 affects Croogo CMS versions up to 4.0.7. The vulnerability lies in the Admin File Manager component, specifically FileManager::isEditable in FileManager/src/Utility/FileManager.php, leading to path traversal. Exploitation can be performed remotely; a working exploit has been publis...

[SECURITY] Fedora 44 Update: opam-2.5.2-1.fc44

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...

[SECURITY] Fedora 44 Update: uv-0.11.28-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

[SECURITY] Fedora 43 Update: uv-0.11.28-1.fc43

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

OESA-2026-3038 NetworkManager security update

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHC...

CVE-2026-48015 Shopware: Stored XSS via SVG file upload — no SVG sanitization

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowedextensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from...

CVE-2026-48015 Shopware: Stored XSS via SVG file upload — no SVG sanitization

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowedextensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from...

CVE-2026-16015

The CVE-2026-16015 affects poco-ai poco-claw up to version 0.5.4, impacting the executor_manager API: specifically the create_task function in executor_manager/app/api/v1/tasks.py. The vulnerability allows manipulation that leads to missing authentication, with public exploits reported. A fix is ...

EUVD-2026-45171

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function createtask of the file executormanager/app/api/v1/tasks.py of the component executormanager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...