Июльский Linux Patch Wednesday

July Linux Patch Wednesday. A total of 2,017 vulnerabilities were addressed 539 in the Linux kernel and 504 in Chromium. For comparison, there were 1,888 vulnerabilities in June. Once again, a new record. Moreover, next month will most likely set another record, as 1,704 vulnerabilities have...

Chromium: CVE-2026-17743 Insufficient policy enforcement in ControlledFrame

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

ROOT-OS-DEBIAN-12-CVE-2026-58010 CVE-2026-58010 in rootio-glib2.0 - Patched by Root

Root has patched CVE-2026-58010 in the rootio-glib2.0 package for Root:Debian:12. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2021-46877 CVE-2021-46877 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2021-46877 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-25649 CVE-2020-25649 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-25649 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

vulnerabilities in Adobe Campaign Classic

Adobe has identified vulnerabilities in Adobe Campaign Classic ACC. The first vulnerability relates to incorrect authorization in ACC’s core authorization mechanisms, allowing attackers to execute arbitrary code without any user interaction. This means that attackers can perform actions beyond th...

Linux Distros Unpatched Vulnerability : CVE-2026-63033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte...

Linux Distros Unpatched Vulnerability : CVE-2026-61893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the...

openSUSE 16: java-25-openjdk / java-25-openjdk-demo / java-25-openjdk-devel / etc (openSUSE-SU-2026:21467-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21467-1 advisory. - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-55707

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets fro...

SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3392-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3392-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues: The following security issues were fixed: -...

Fedora 44 : nextcloud (2026-df06189438)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-df06189438 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

SUSE SLES15 Security Update : kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3393-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3393-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.55 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-65423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

Linux Distros Unpatched Vulnerability : CVE-2026-9672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before...

Linux Distros Unpatched Vulnerability : CVE-2026-66756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommende...

Important Photon OS Security Update - PHSA-2026-5.0-92-0936

Updates of 'libtiff' packages of Photon OS have been released...

CVE-2026-67527

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...