Linux Distros Unpatched Vulnerability : CVE-2026-80583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses The DEC0 MODE to DEC7 MODE controls are enumerated, but txmacrodecmodeget and txmacrodecmodeput access...

CVE-2025-51679

CVE-2025-51679 affects the openRISC OR1200 processor at commit 83ac6b , where a mismatch between the RTL (Register Transfer Level) and the netlist can lead to unexpected behavior . The CNA-assigned CVSS 3.1 score is 9.1 (CRITICAL) , with a network attack vector , low complexity , no privileges re...

PT-2026-82185

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the synaptics-rmi4 driver where the rmi f54 work function reads a diagnostics report into the f54-report data buffer. The transfer size is determined by rmi f54 get...

PT-2026-82116

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cls bpf prog from efd function where it fails to verify if a device-bound offloaded program's bound network device matches the TC network device it is being attach...

Linux Distros Unpatched Vulnerability : CVE-2026-80569

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmif54work reads a diagnostics report from the device into f54-reportdata, sizing the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098752)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098752 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix warning message due to adisc being flushed Fix warning message due to adisc...

EUVD-2025-210801

An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098968)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098968 advisory. In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in genevefinddev. syzkaller reported a use-after-free in genevefinddev...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input through the built-in coerceString and coerceBool scalar coercion functions in scalars.go. An attacker can trigger request handling errors or crash the process by supplying a scalar variable...

curl: CVE-2026-80231: native CA store conn reuse

Summary nativecastore is in struct sslconfigdata line 73 of vtlsconfig.h, not sslprimaryconfig. matchsslprimaryconfig does not compare it. On macOS, Curlssleasyconfigcomplete line 258 auto-sets nativecastore = TRUE when no custom CA is configured — without modifying ssloptions. When CURLCABUNDLE ...

curl: CVE-2026-80229: OpenSSL provider use-after-free

Summary When CURLOPTSSLENGINE is set e.g. "default" on OpenSSL 3.x, osslsetprovider line 1791 allocates a per-handle OSSLLIBCTX and stores it in data-state.libctx. During TLS connection setup, SSLCTXnewex line 3750 receives this library context and embeds a pointer to it inside the newly created...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

CVE-2026-59189

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep imag...

CVE-2026-59189

OpenEXRUtil (the reference implementation for the EXR image format used in the motion picture industry) is affected in versions 3.3.0–3.3.12 and 3.4.0–3.4.12 by a heap out-of-bounds read in the TypedDeepImageChannel::row() API. The root cause is a conflict between two coordinate models: at(x, y) ...

EUVD-2026-65589

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occur...

GHSA-VFP3-V2GW-7WFQ Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls...

CVE-2026-55529

PraisonAI (a multi-agent teams system) has an origin validation bypass in its MCP HTTP Stream transport. The _validate_origin method uses request_origin.startswith(allowed), so an attacker-controlled origin like http://localhost.evil.example matches the http://localhost allowlist entry via prefix...

CVE-2026-77145

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...

EUVD-2026-65331

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...

PT-2026-81215

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An integer overflow exists in the WebRTC component. The issue occurs in the RTCRtpSender.setParameters path, where a WebIDL unsigned long maxBitrate is converted into a signed C++ int,...