Linux Distros Unpatched Vulnerability : CVE-2026-58380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte...

ROS-20260707-73-0041

The vulnerability in dovecot is related to manipulating an unknown input, resulting in a time mismatch vulnerability. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ALSA-2026:36320 Important: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack CVE-2026-40622 unbound: Unbound: Denial of...

Linux lpddr2_nvm_probe Memory Driver DoS

The vulnerability of the lpddr2nvmprobe function in the drivers/mtd/lpddr/lpddr2nvm.c module of the Linux operating system’s memory driver lies in the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

DRI Support Driver Heap Buffer Overflow DoS

The vulnerability of the dpucoreirqcallbackhandler function in the drivers/gpu/drm/msm/disp/dpu1/dpuhw Interrupts.c file of the DRI support driver for the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the scmsmccall function in the drivers/firmware/qcom/qcomscm-smc.c driver for Linux kernel-based operating systems is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

amdgpu_cs parser_init() Heap Buffer Overflow DoS

The vulnerability of the amdgpucs parserinit function in the drivers/gpu/drm/amd/amdgpu/amdgpucs.c driver module relates to the pointer manipulation in the AMD GPU kernel support for Linux operating systems. Exploiting this vulnerability can allow an attacker to cause a service failure...

Ext4 inode() Heap Buffer Overflow DoS

The vulnerability of the ext4getjournal inode function in the fs/ext4/super.c file of the Ext4 file system in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Brute Force

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Brute Force in the authentication process. An attacker can gain unauthorized access to administrative functions by sending repeated login attempts with different values in the...

SUSE-SU-2026:22564-1 Security update for apache2

This update for apache2 fixes the following issues - CVE-2026-29167: modldap per-dir use-after-free bsc1267976. - CVE-2026-29170: modproxyftp XSS bsc1267977. - CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. - CVE-2026-34356: malicious backend servers can lead to a heap-based buffer...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35373 via uu_ln (>=0.0.14, <=0.0.16)

uuln CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35373 Source advisory: OSV:GHSA-JCJR-RH8Q-7XQF...

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

UBUNTU-CVE-2026-58380

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption,...

CVE-2026-54893

Swoosh.Adapters.MsGraph is vulnerable to URL path injection via the from-address interpolation into /users/{from}/sendMail without percent-encoding or validation. If from derives from untrusted input, an attacker can inject URL-special characters (/, ?, #) to escape the intended path and rewrite ...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the JmsBinding.extractBodyFromJms process when handling JMS ObjectMessages with the mapJmsMessage option enabled. An attacker can inject arbitrary Exchange state by publishing a crafted ObjectMessage...

CVE-2026-58467

A flaw was found in Cockpit CMS. This vulnerability, a path traversal and local file inclusion, allows an unauthenticated attacker to read arbitrary files or execute PHP files. By manipulating the URL, an attacker can bypass security checks and access restricted directories. This could lead to...

CVE-2026-12686 Incorrect authorisation in Adiss’s Biloop

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

EUVD-2026-41860

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user...

CVE-2026-12686

CVE-2026-12686 affects Adiss’s Biloop: an authenticated user can manipulate a company ID in a POST to the backend, bypassing cross-tenant authorization and gaining access to other companies’ data (including billing) and potentially modifying third-party data. Root cause is inadequate verification...

CVE-2026-46584 Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer MailProducer.getSender scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present...