TencentOS Server 4: hostapd (TSSA-2026:0609)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0609 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Amazon Linux 2023 : python3-pygments (ALAS2023-2026-1973)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1973 advisory. A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular...

Amazon Linux 2023 : glib2, glib2-devel, glib2-static (ALAS2023-2026-1942)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1942 advisory. A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check...

PT-2026-61674

The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...

CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

CVE-2026-63838

In the Linux kernel, the following vulnerability has been resolved: ASoC: rsnd: Fix potential out-of-bounds access of componentdais componentdaisRSNDMAXCOMPONENT is initially zero-initialized and later populated in rsnddaiofnode. However, the existing boundary check: if i = RSNDMAXCOMPONENT does...

PT-2026-61599

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...

TencentOS Server 3: libreoffice (TSSA-2026:0633)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0633 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Important: glib2

Issue Overview: A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses instead of =, causing an out-of-bounds read of only 1 byte. This issue can cause a...

UBUNTU-CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

Linux Distros Unpatched Vulnerability : CVE-2026-64030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is...

UBUNTU-CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...

PT-2026-61808

Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS...

MAL-2026-10781 Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

Malicious code in chart-animation-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa890c03c6122833b54a469ef025c3761dfb6fa3a6cd299152de54ce98d9aedd Package is published as 'chart-animation-helper' and described as 'Lightweight chart animation utilities', but the module contains no chart or...

DEBIAN-CVE-2026-64097

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...

CVE-2026-64097

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...

DEBIAN-CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...

CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...

DEBIAN-CVE-2026-64017

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blkmqfreeplugrqs, freeing the cachedrqs. This...