SUSE CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

SUSE CVE-2026-68177

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...

SUSE CVE-2026-68178

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

SUSE CVE-2026-68205

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

Seafile server-controlled sync path can escape the client worktree (macOS/Linux)

Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...

WeKan CAS login shares module-level global user data, enabling concurrent account takeover (CasBleed)

WeKan CAS Login Shares Module-Level Global User Data, Enabling Concurrent Account Takeover CasBleed Vulnerability Overview WeKan's CAS single sign-on implementation contains a concurrent race condition flaw: the user identity data returned by the CAS server after ticket validation is stored in a...

CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

UBUNTU-CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.

Summary TSSC/IMC addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2026-22007 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE...

ALPINE-CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

DEBIAN-CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

AZL-95801 CVE-2026-70463 affecting package rsync for versions less than 3.5.0-1

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

ALPINE-CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

DEBIAN-CVE-2026-70463

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

AZL-95792 CVE-2026-70464 affecting package rsync for versions less than 3.5.0-1

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

UBUNTU-CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

DEBIAN-CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...