SUSE-SU-2026:2930-1 Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.3 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

PYSEC-2026-2765 Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories

Summary Any authenticated user can read other users' private memories via /api/v1/retrieval/query/collection Details Vulnerability 1: Missing authorization in collection querying In backend/openwebui/routers/retrieval.py, the querycollectionhandler function accepts a list of collectionnames but...

kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

A flaw was found in the Linux kernel, specifically within the RDMA Remote Direct Memory Access vmwpvrdma module. This vulnerability is a double free, which means the system attempts to release the same memory resource twice. This can occur in an error handling path within the pvrdmaallocucontext...

The vulnerability of the metaencoder of the console-based graphic editor ImageMagick, which allows a hacker to disclose protected information

The vulnerability of the metaencoder in the console-based graphic editor ImageMagick relates to reading data outside of the permitted range in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

CVE-2026-7639

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

EUVD-2026-43037

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

CVE-2026-7639 GPU DDK - Page UAF read in PMMETA_PROTECT heap memory

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

CVE-2026-7639

Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code. Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete...

Oracle Linux 9 : kernel (ELSA-2026-30848)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-30848 advisory. - RDMA/mlx5: Fix error path fall-through in mlx5ibdevressrqinit CKI Backport Bot RHEL-179994 CVE-2026-46176 - RDMA/vmwpvrdma: Fix double free on...

CVE-2026-15109

Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-15109

Summary: CVE-2026-15109 affects Google Chrome via an uninitialized use in ANGLE. Affected component: ANGLE in Chrome. Impact: remote attacker could potentially read sensitive data from process memory by enticing a user to visit a crafted HTML page. Versions: Chrome prior to 150.0.7871.115 are aff...

BIT-PYTHON-MIN-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

CVE-2026-57237

CVE-2026-57237 impacts Foxit PDF Editor/Reader (annotation handling) where JavaScript modifying form-field properties leaves underlying objects in an invalid state, triggering a use-after-free and reading an illegal memory address. This can crash the application. The Connected documents do not pr...

EUVD-2026-42196

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application...

CVE-2026-57237

When the application opens a PDF and JavaScript modifies the properties of form fields, it causes the state of the underlying objects referenced by the program to become invalid. Eventually, it reads an illegal memory address, which leads to the crash of the application...

PT-2026-57874

Name of the Vulnerable Software and Affected Versions Ollama affected versions not specified Description A flaw in the downloadBlob function allows remote, unauthenticated attackers to cause a denial-of-service condition. The issue stems from improper validation of user-supplied data, leading to ...

The vulnerability of the `__team_queue_override_enabled_check()` function in the drivers/net/team/team_core.c file of the Linux kernel’s network device driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the teamqueueoverrideenabledcheck function in the drivers/net/team/teamcore.c file of the Linux kernel’s network device driver is related to the occurrence of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-57851

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

PYSEC-2026-1909 Sentencepiece has a a heap overflow issue

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure...

CVE-2026-57851

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...