CVE-2026-28696 Craft affected by IDOR via GraphQL @parseRefs

Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags e.g., user:1:email, can be abused by both authenticated users and unauthenticated guests if a Public Schema is enabled to access sensitive...

CVE-2026-28696 Craft affected by IDOR via GraphQL @parseRefs

Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags e.g., user:1:email, can be abused by both authenticated users and unauthenticated guests if a Public Schema is enabled to access sensitive...

openssl security update

3.5.1-7.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.1-7 - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469 CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420 CVE-2025-69421 CVE-2026-22795 CVE-2026-227...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004899)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004899 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolveindirectrefs During backref walking, ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002674)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002674 advisory. Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4extdroprefs function when operating on a crafted ext4 filesystem image. Tenable has...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002726)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002726 advisory. Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4extdroprefs function when operating on a crafted ext4 filesystem image. Tenable has...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001605)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001605 advisory. Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4extdroprefs function when operating on a crafted ext4 filesystem image. Tenable has...

CVE-2025-40925

Starch versions 0.14 and earlier generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with a counter, the epoch time, the built-in rand function, the PID, and internal Perl reference addresses. The PID will come from a small set of numbers, and the epoch...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992733)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992733 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolveindirectrefs During backref walking, ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992552)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992552 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix inode list leak during backref walking at resolveindirectrefs During backref walking, ...

SUSE CVE-2025-68366

In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbdgenlconnect There is one use-after-free warning when running NBDCMDCONNECT and NBDCLEARSOCK: nbdgenlconnect nbdallocandinitconfig // configrefs=1 nbdstartdevice // configrefs=2 set NBDRTHASCONFIGREF...

KB5071417: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (December 2025)

The remote Windows host is missing security update 5071417. It is, therefore, affected by multiple vulnerabilities - Untrusted pointer dereference in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network. CVE-2025-62549 - Heap-based buffer...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990863)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990863 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUGONrefs == 0, which...

CVE-2025-59210

Windows Resilient File System ReFS Deduplication Service Elevation of Privilege Vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2023-53645

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Make bpfrefcountacquire fallible for non-owning refs This patch fixes an incorrect...

SUSE CVE-2023-53645

In the Linux kernel, the following vulnerability has been resolved: bpf: Make bpfrefcountacquire fallible for non-owning refs This patch fixes an incorrect assumption made in the original bpfrefcount series 0, specifically that the BPF program calling bpfrefcountacquire on some node can always...

CVE-2023-53645

In the Linux kernel, the following vulnerability has been resolved: bpf: Make bpfrefcountacquire fallible for non-owning refs This patch fixes an incorrect assumption made in the original bpfrefcount series 0, specifically that the BPF program calling bpfrefcountacquire on some node can always...

CVE-2023-53645

CVE-2023-53645 : Linux kernel patch fixes a use-after-free risk in BPF non-owning references by making bpf_refcount_acquire fallible. The fix changes the implementation (bpf_refcount_acquire_impl) to use refcount_inc_not_zero and return KF_RET_NULL, preventing increment on a possibly freed object...

CVE-2023-53645

In the Linux kernel, the following vulnerability has been resolved: bpf: Make bpfrefcountacquire fallible for non-owning refs This patch fixes an incorrect assumption made in the original bpfrefcount series 0, specifically that the BPF program calling bpfrefcountacquire on some node can always...

CVE-2023-53645 bpf: Make bpf_refcount_acquire fallible for non-owning refs

In the Linux kernel, the following vulnerability has been resolved: bpf: Make bpfrefcountacquire fallible for non-owning refs This patch fixes an incorrect assumption made in the original bpfrefcount series 0, specifically that the BPF program calling bpfrefcountacquire on some node can always...