UBUNTU-CVE-2026-110678

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion...

UBUNTU-CVE-2026-110684

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory...

PT-2026-121946

In the Linux kernel, the following vulnerability has been resolved: net/sched: em text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in em text dump", which zero-initialised the dump-side struct. Sashiko pointed at a...

Linux Distros Unpatched Vulnerability : CVE-2026-114136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in restframework/parsers.py uses the client-supplied...

PT-2026-122022

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h free logical LAN on open-fail after register ibmveth open registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan, so PHYP still owns the...

Linux Distros Unpatched Vulnerability : CVE-2026-99006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during...

Linux Distros Unpatched Vulnerability : CVE-2026-99045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to...

ROS-20261023-73-0014

The vulnerability of the dnsnametolabels function in the Libevent asynchronous event notification library is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-122213

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate tlb page in arch/arm64/core/mmu.c, which issued TLBI VAE1IS with an operand of virt 12. That operand encodes the ASID in bits 63:48, so the invalidation only ever matched ASID 0 the kernel page tables and glob...

Linux Distros Unpatched Vulnerability : CVE-2026-98947

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add...

Linux Distros Unpatched Vulnerability : CVE-2026-99043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst...

PT-2026-121865

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/mlx5 HWS component where deleting a table that has a miss table created via the mlx5hws table set default miss function does not properly remove the table from...

PT-2026-121879

In the Linux kernel, the following vulnerability has been resolved: net: cpsw new: unregister devlink on port registration failure cpsw probe registers devlink before registering the CPSW ports. If cpsw register ports fails, the error path only unregisters the notifiers and then releases the lowe...

PT-2026-122442

Summary create entity, link entities, rename entity, unlink entities and delete entity regenerate a memory note's body from SQLite at the computed memory//.md path. When a note already existed at that path and was not owned by the entity being written a hand-authored note, or an orphan left by a...

PT-2026-122123

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, create entity, link entities, rename entity, unlink entities and delete entity regenerate memory notes from SQLite at the computed memory//.md path without reliably preserving note...

ROS-20261023-73-0022

The vulnerability in libssh2 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-98882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a...

Linux Distros Unpatched Vulnerability : CVE-2026-113795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that...

Linux Distros Unpatched Vulnerability : CVE-2026-99057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error a...

Linux Distros Unpatched Vulnerability : CVE-2026-99028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre- submits RX buffers and holds in-flight TX buffers who...