ROS-20260803-73-0032

The vulnerability of the eswinlinemodetodevlink function in the drivers/net/ethernet/mellanox/mlx5/core/eswitchoffloads.c file of the Mellanox Ethernet adapter support driver for Linux operating systems is related to improper release of resources. Exploiting this vulnerability could allow an...

PT-2026-67500

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add content of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. T...

[SECURITY] [DSA 6409-1] libgd2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6409-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 01, 2026 https://www.debian.org/security/faq -...

CVE-2026-15028 affecting package libarchive for versions less than 3.7.7-7

CVE-2026-15028 affecting package libarchive for versions less than 3.7.7-7. A patched version of the package is available...

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48145 affecting package thrift for versions less than 0.24.0-1

CVE-2026-48145 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-56852 affecting package telegraf for versions less than 1.31.0-25

CVE-2026-56852 affecting package telegraf for versions less than 1.31.0-25. A patched version of the package is available...

SUSE CVE-2026-58402

Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-..." data-lang="..." wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks...

SUSE CVE-2026-58404

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including...

SUSE CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

OPENSUSE-SU-2026:11430-1 librrd8-1.10.3-1.1 on GA media

These are all security issues fixed in the librrd8-1.10.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11426-1 python310-3.10.20-8.1 on GA media

These are all security issues fixed in the python310-3.10.20-8.1 package on the GA media of openSUSE Tumbleweed...

[SECURITY] [DSA 6407-1] incus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6407-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 31, 2026 https://www.debian.org/security/faq -...

CVE-2026-62959

Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location...

CVE-2026-62999

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

Chromium: CVE-2026-17727 Out of bounds write in WebGL

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-17756 Insufficient policy enforcement in Presentation

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

PT-2026-66745

Name of the Vulnerable Software and Affected Versions Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2 Description HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager when it encounters an invalid or unsupport...

The vulnerability of the usbtmc_release() function in the drivers/usb/class/usbtmc.c module of the Linux operating system’s USB device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the usbtmcrelease function in the drivers/usb/class/usbtmc.c module of the Linux device driver framework is related to the pointer being reclaimed after its expiration. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...