The vulnerability of the set_tagged_addr_ctrl() function in the arch/riscv/kernel/process.c module of the module management subsystem for the RISCV architecture-based Linux operating system allows a attacker to trigger a service failure.

The vulnerability of the settaggedaddrctrl function in the arch/riscv/kernel/process.c module of the module for managing modules on the RISCV architecture-based Linux operating system is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attack...

Photon OS 5.0: Linux PHSA-2026-5.0-0904

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0904. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption

...

RLSA-2026:28581 Important: python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

[SECURITY] Fedora 43 Update: docker-buildkit-0.31.0-1.fc43

Concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit...

[SECURITY] Fedora 43 Update: nginx-mod-fancyindex-0.6.0-6.fc43

The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: Custom headers. Either local or stored remotely. Cust...

[SECURITY] Fedora 43 Update: ldns-1.9.2-1.fc43

ldns is a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets...

RLSA-2023:2786 Moderate: wayland security, bug fix, and enhancement update

Wayland is a protocol for a compositor to talk to its clients, as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a wayland client itself. The clients can be...

Linux Kernel Memory Vulnerability (CNVD-2026-26372)

The Linux kernel is the core of the Linux operating system, responsible for managing system resources, process scheduling, file systems, and other functions. The Linux kernel has a memory corruption vulnerability. This vulnerability arises due to the btrfs module releasing dirty page IO trees...

The vulnerability of the verity_fec_decode() function in the drivers/md/dm-verity-fec.c file of the device driver for multiple Linux device types (RAID and LVM), allowing a hacker to cause a service failure.

The vulnerability of the verityfecdecode function in the drivers/md/dm-verity-fec.c file of the Linux device driver for multiple devices such as RAID and LVM is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause a service...

PT-2026-53342

These are all security issues fixed in the python311-jupyter-ydoc-3.5.0-1.1 package on the GA media of openSUSE Tumbleweed...

EulerOS 2.0 SP15 : nghttp2 (EulerOS-SA-2026-2494)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2658-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2658-1 advisory. The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: -...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the id parameter in playlist operations. An attacker can access or delete other users' playlists, and probe for the existence of arbitrary files by supplying a crafted base64-encoded...

Statamic Vulnerable to CSV formula injection in form submission exports

Impact Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character e.g. = , + , - , @ could be interpreted as a live formula when a Control Panel user opens the export in a...

GHSA-M92M-R54R-X8R2 Statamic CMS's unsafe method invocation via collection sorting allows data destruction

Impact The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could result in the loss of content and assets. This requires a front-end template that passes...

CVE-2026-53300

In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potential DMA use-after-free issue 1. If netcxmitntmpcmd times out and returns an error, the pending command is not explicitly aborted, while...

DEBIAN-CVE-2026-53290

In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drmdevput called before stream disable in close In xeeustallstreamclose, drmdevput is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures...

CVE-2026-53286

In the Linux kernel, the following vulnerability has been resolved: idpf: fix double free and use-after-free in aux device error paths When auxiliarydeviceadd fails in idpfplugvportauxdev or idpfplugcoreauxdev, the errauxdevadd label calls auxiliarydeviceuninit and falls through to errauxdevinit...

CVE-2026-52884

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory does NOT canonicalize the path before checking. It uses a prefix-based check PathIsPrefix or equivalent that matches paths starting with trusted directory strings. A path traversal using ....\ after a truste...