CVE-2026-14681: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS...

CVE-2026-73583: Out-of-bounds Read

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

UBUNTU-CVE-2026-73149

GHSA-mh75-5pr3-qv2p: NetRx: out-of-bounds read via unvalidated MsgAudio length...

CVE-2026-73152

GHSA-4g8q-rgxf-fmgf: EchoLink proxy: integer truncation in message length...

ALSA-2026:54576 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

CVE-2026-65932: Expected Behavior Violation

The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below...

PT-2026-71647

The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below...

PT-2026-71458

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication IPC message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access,...

PT-2026-71649

An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below...

CVE-2026-73150

GHSA-4f8x-49pf-3x5v: Buffer overflow in APRS message construction...

UBUNTU-CVE-2026-73150

GHSA-4f8x-49pf-3x5v: Buffer overflow in APRS message construction...

CVE-2026-53788: Improper Neutralization of CRLF Sequences

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

PT-2026-71662

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x Description A signed integer overflow exists in the I/O timeout implementation. An attacker can inject MSG IO TIMEOUT messages containing non-positive values zero or negative, causing the timeout variable to...

UBUNTU-CVE-2026-73152

GHSA-4g8q-rgxf-fmgf: EchoLink proxy: integer truncation in message length...

ALSA-2026:54575 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

Linux Distros Unpatched Vulnerability : CVE-2026-73583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's...

Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

CVE-2026-73493 http4s-blaze-server: Unbounded WebSocket message aggregation

Http4s http4s-blaze-server is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an...

CVE-2026-72568

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port...

Missing Authorization

Apache ActiveMQ is vulnerable to a Missing Authorization vulnerability. The vulnerability is due to temporary destination isolation being enforced only on the client side, which allows an attacker to bypass the authorization check and consume messages from another connection's temporary destinati...