Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150491 advisory. Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type...

CVE-2026-120758

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect unpins it on the final unprotect. When the metadata cache...

SUSE-SU-2026:5099-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and executed bsc1284043. - CVE-2026-42528: memory calculation bug in moddav allows an attacker with permission to creat...

SUSE CVE-2026-99247

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers, tracingdisabled is left set to 1 and the global trace array events...

SUSE CVE-2026-121401

FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a...

SUSE CVE-2026-121402

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap upda...

CVE-2026-121402

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap upda...

OESA-2026-4723 qt6-qtbase security update

Qt is a software toolkit for developing applications. Security Fixes: A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.CVE-2026-105924 Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Q...

OESA-2026-4721 qt6-qtbase security update

Qt is a software toolkit for developing applications. Security Fixes: A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module.CVE-2026-105924 Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Q...

CVE-2026-117610

A flaw was found in expat. A remote attacker who controls input stream chunking can trigger a NULL pointer dereference by forcing an empty initial parse on an external entity subparser. Successful exploitation causes the application to crash, resulting in a Denial of Service DoS. Mitigation Avoid...

CVE-2026-99225

A flaw was found in the Linux kernel. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. This flaw occurs due to a race condition in the key management subsystem during process keyring searches, where revoking an authorization key concurrent...

CVE-2026-99220

A flaw was found in the Linux kernel. A local, unprivileged attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. The issue occurs within the asymmetric key management subsystem when applying restrictions using a key that lacks identifiers, such as a...

CVE-2026-121401

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop RD Gateway can cause a Denial of Service DoS by sending an unexpected extended-authentication packet prior to tunnel authentication. Due to missing verification of the negotiated authentication context, processing this packet...

CVE-2026-57486

A flaw was found in pupnp. A remote attacker could cause a Denial of Service DoS by sending specially crafted XML data to an affected application. Due to improper validation of null values during XML node comparisons, processing this input triggers a NULL pointer dereference that crashes the...

CVE-2026-99247

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers, tracingdisabled is left set to 1 and the global trace array events...

CVE-2026-99257

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...

Linux Distros Unpatched Vulnerability : CVE-2026-121402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPG...

Linux Distros Unpatched Vulnerability : CVE-2026-120758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local...

Linux Distros Unpatched Vulnerability : CVE-2026-121401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or...

qt: qt: Denial of Service via NULL pointer dereference during QCborValue to JSON conversion

A flaw was found in Qt. This vulnerability allows an attacker to trigger a Denial of Service DoS by providing specially crafted Concise Binary Object Representation CBOR data. When the application converts this input into JavaScript Object Notation JSON format using QCborValue, a NULL pointer...