RockyLinux 8 : php:7.4 (RLSA-2026:34354)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:34354 advisory. php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via imprope...

AlmaLinux 9 : php (ALSA-2026:33449)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:33449 advisory. php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via improper...

PT-2026-54802

In the Linux kernel, the following vulnerability has been resolved: mm/damon/reclaim: handle ctx allocation failure Patch series "mm/damon/reclaim,lru sort: handle ctx allocation failures". DAMON RECLAIM and DAMON LRU SORT could dereference NULL pointers if their damon ctx object allocations fail...

The vulnerability of the mon_handle_auth_done() function in the net/ceph/mon_client.c module, which is part of the Linux kernel’s networking functions, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the monhandleauthdone function in the net/ceph/monclient.c module, which is part of the Linux kernel’s networking functions, relates to the use of pointers. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility o...

Important: php:7.4 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6722 PHP: PHP: Denial of Service via improper handling of signed characters in ctype...

CVE-2026-36909

A NULL pointer dereference in the AP4TkhdAtom::GetTrackId function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

PT-2026-54806

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add NULL check for of reserved mem lookup in airoha qdma init hfwd queues of reserved mem lookup may return NULL if the reserved memory region referenced by the "memory-region" phandle is not found in the reserved...

CVE-2026-36912

A NULL pointer dereference in the AP4AtomSampleTable::GetSample function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

PT-2026-54818

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the ASOC wm adsp component during the removal of firmware controls. The function wm adsp control remove attempts to clean up private data pointed to by the...

PT-2026-54803

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lru sort: handle ctx allocation failure DAMON LRU SORT allocates the damon ctx object for its kdamond in its init function. damon lru sort enabled store wrongly assumes the allocation will always succeed once tried. If t...

PT-2026-54805

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bond do ioctl In bond do ioctl, slave dev is obtained via dev get by name which can return NULL if the requested interface name does not exist. However, the subsequent slave dbg call ...

PT-2026-54757

Name of the Vulnerable Software and Affected Versions Aleksoid1978 MPC-BE versions prior to commit 4341cb3 Description A NULL pointer dereference occurs in the AP4 AtomSampleTable::GetSample function. This issue allows an attacker to trigger a Denial of Service DoS by providing a specially crafte...

PT-2026-54817

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack: destroy stale expectfn expectations on unregister NAT helpers such as nf nat h323 store a raw pointer to module text in exp-expectfn e.g. ip nat q931 expect. nf ct helper expectfn unregister only unlinks...

SUSE-SU-2026:22436-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs bsc1266290. - CVE-2025-68822: Input: alps - fix use-after-free bugs caused by...

EUVD-2026-9141

Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence...

GHSA-RXPR-WQ63-JR7P Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence

Summary A memory-safety vulnerability in Open Babel's CDXML file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::GetExplicitValence as called from the CDXML parser. A malformed fragment caused the parser to invoke the method on a...

GHSA-4W5W-4FHM-Q483 Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge

Summary A memory-safety vulnerability in Open Babel's MOL2 file format parser caused a NULL pointer dereference when reading a crafted input file. Details The flaw was in OBAtom::SetFormalCharge as called from the MOL2 parser. A malformed atom record caused the parser to call the method on a NULL...

CVE-2026-58369 Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Service

Woodpecker before 3.15.0 registers the /api/orgs/lookup/orgfullname endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user user.ForgeID, via ForgeFromUser when selecting the forge to query. For an unauthenticated request session.User...

EUVD-2026-40357

Woodpecker before 3.15.0 registers the /api/orgs/lookup/orgfullname endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user user.ForgeID, via ForgeFromUser when selecting the forge to query. For an unauthenticated request session.User...

CVE-2026-58369

Woodpecker before 3.15.0 registers the /api/orgs/lookup/orgfullname endpoint without authentication middleware, and the LookupOrg handler unconditionally dereferences the session user user.ForgeID, via ForgeFromUser when selecting the forge to query. For an unauthenticated request session.User...