Linux Distros Unpatched Vulnerability : CVE-2026-64173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never...

Linux Distros Unpatched Vulnerability : CVE-2026-63841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.0.1 ring JPEG rings do not support 64-bit user...

Linux Distros Unpatched Vulnerability : CVE-2026-63864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a bpf: correct stack liveness...

Linux Distros Unpatched Vulnerability : CVE-2026-64000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV heade...

CVE-2026-63964

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

UBUNTU-CVE-2026-63952

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

UBUNTU-CVE-2026-63906

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430probe In omap2430probe, ofnodeputnp is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the ofnodepu...

Linux Distros Unpatched Vulnerability : CVE-2026-64108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c cifs: open files shou...

Linux Distros Unpatched Vulnerability : CVE-2026-63988

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history,...

Linux Distros Unpatched Vulnerability : CVE-2026-63974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set...

Linux Distros Unpatched Vulnerability : CVE-2026-63877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serial: dz: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to colour frame buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-64023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: aggregator: fix a potential use-after-free On error we free aggr-lookups-devid before removing the entry from the lookup table. If a concurrent thread cal...

Linux Distros Unpatched Vulnerability : CVE-2026-6656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The checkpassword method uses the built-in eq operator. This allows...

Important: unbound

Issue Overview: NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary c...

Amazon Linux 2 : unbound, --advisory ALAS2UNBOUND-1.17-2026-008 (ALASUNBOUND-1.17-2026-008)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2UNBOUND-1.17-2026-008 advisory. NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that...

Medium: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption CVE-2026-46331 Affected Packages: kernel6.12 Issue Correction: Run dnf update kernel6.12 --releasever 2023.12.20260720 or dnf update --advisory...

PT-2026-61652

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.640 Description Webmin is a web-based system administration tool for Unix-like servers. An attacker who possesses a valid username and password can bypass the two-factor authentication 2FA requirement, such as...

PT-2026-61567

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...

PT-2026-61629

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes...

CVE-2026-63751: Incorrect Authorization

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including...