DRUPAL-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

DRUPAL-CONTRIB-2026-145

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...

DRUPAL-CONTRIB-2026-142

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network...

DRUPAL-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

CVE-2026-80923

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

AZL-99954 CVE-2026-80923 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

DEBIAN-CVE-2026-80923

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

DRUPAL-CONTRIB-2026-137

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...

CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

EUVD-2026-75100

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

CVE-2026-80923

CVE-2026-80923 is a use-after-free in the Linux kernel's xhci dbgtty driver. When tty_register_driver() fails during module initialization, the driver reference is dropped but the global dbc_tty_driver pointer is left dangling (not set to NULL). Upon module unload, dbc_tty_exit() sees the non-NUL...

CVE-2026-87872

A flaw in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection hardcodes validate_certs=false in the shared request helper with no parameter to re-enable it. Because the modules send HTTP Basic-Auth credentials over HTTPS, an attacker positioned on the network...

DEBIAN-CVE-2026-73324

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

USN-8675-2 perl vulnerabilities

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS. Original advisory details: It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an...

USN-8675-2: Perl vulnerabilities

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS. Original advisory details: It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an...

CVE-2026-73324

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

CVE-2026-73324

VLC media player 3.0.0 through 3.0.23 is affected by a heap out-of-bounds read in the RTSP module. The root cause is that RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length without guaranteeing null termination, and rtsp_get in modules/access/rtsp/rtsp.c passes...

CVE-2026-73324 VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...