EUVD-2026-39309

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftexthdr: fix register tracking for FPRESENT flag nftexthdrinit passes user-controlled priv-len to nftparseregisterstore, which marks that many bytes in the register bitmap as initialized. However, when...

CVE-2026-53208 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2capcore.c:l2capsigchannel accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU MTUsig...

EUVD-2026-39238

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer...

SUSE-SU-2026:2626-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments directly to urllib.request.urlopen and allows for SSRF and token forgery bsc1266798. - CVE-2026-48523: verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are...

CVE-2026-9702

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or...

CVE-2026-12490

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port and not the tls-auth-port or over over TCP over the regular...

CVE-2026-54512 vulnerabilities

Vulnerabilities for packages: apache-tomee, localstack, nextflow, seata, guacamole-client, kafbat-ui-fips, spark-fips, s3proxy-fips, kayenta-fips, apache-tika, solr, ontop-fips, kserve-modelmesh, knative-kafka-broker-fips, apache-hop-fips, jmeter, apache-camel-karavan-devmode,...

CVE-2026-54514 vulnerabilities

Vulnerabilities for packages: apache-tomee, localstack, nextflow, seata, guacamole-client, kafbat-ui-fips, spark-fips, s3proxy-fips, kayenta-fips, apache-tika, solr, ontop-fips, kserve-modelmesh, knative-kafka-broker-fips, apache-hop-fips, jmeter, apache-camel-karavan-devmode,...

GHSA-RCQC-6CW3-H962 vulnerabilities

Vulnerabilities for packages: airbyte-server, cassandra, apache-tomee, airbyte-server-fips, neo4j, nextflow, apache-activemq, spdx-tools-java, management-api-for-apache-cassandra-4.0, trino, druid, jenkins, strimzi-kafka-operator-fips, opensearch, pinot, ruby3.2-jrjackson, ruby4.0-jrjackson, akhq...

GHSA-RMJ7-2VXQ-3G9F vulnerabilities

Vulnerabilities for packages: apache-tomee, localstack, nextflow, seata, guacamole-client, kafbat-ui-fips, spark-fips, s3proxy-fips, kayenta-fips, apache-tika, solr, ontop-fips, kserve-modelmesh, knative-kafka-broker-fips, apache-hop-fips, jmeter, apache-camel-karavan-devmode,...

CVE-2026-54513 vulnerabilities

Vulnerabilities for packages: apache-tomee, localstack, nextflow, seata, guacamole-client, kafbat-ui-fips, spark-fips, s3proxy-fips, kayenta-fips, apache-tika, solr, ontop-fips, kserve-modelmesh, knative-kafka-broker-fips, apache-hop-fips, jmeter, apache-camel-karavan-devmode,...

CVE-2026-54517 vulnerabilities

Vulnerabilities for packages: airbyte-server, cassandra, apache-tomee, airbyte-server-fips, neo4j, nextflow, apache-activemq, spdx-tools-java, management-api-for-apache-cassandra-4.0, trino, druid, jenkins, strimzi-kafka-operator-fips, opensearch, pinot, ruby3.2-jrjackson, ruby4.0-jrjackson, akhq...

CVE-2026-54516 vulnerabilities

Vulnerabilities for packages: airbyte-server, cassandra, apache-tomee, airbyte-server-fips, neo4j, nextflow, apache-activemq, spdx-tools-java, management-api-for-apache-cassandra-4.0, trino, druid, jenkins, strimzi-kafka-operator-fips, opensearch, pinot, ruby3.2-jrjackson, ruby4.0-jrjackson, akhq...

GHSA-9FXM-VC8V-HJ55 vulnerabilities

Vulnerabilities for packages: airbyte-server, cassandra, apache-tomee, airbyte-server-fips, neo4j, nextflow, apache-activemq, spdx-tools-java, management-api-for-apache-cassandra-4.0, trino, druid, jenkins, strimzi-kafka-operator-fips, opensearch, pinot, ruby3.2-jrjackson, ruby4.0-jrjackson, akhq...

Grafana 3.0.1-7.0.1 - Server-Side Request Forgery

Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which can lead to remote code execution. Any unauthenticated user/client can make Grafana send HTTP requests to any URL and return its result. This can be used to gain information about the network...

PT-2026-52545

Name of the Vulnerable Software and Affected Versions NewsBlur versions prior to 14.5.0 Description Authenticated users can perform server-side request forgery SSRF via the 'add url' endpoint. This occurs because the application fails to filter private IP addresses, allowing arbitrary server...

Linux Distros Unpatched Vulnerability : CVE-2026-53072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock...

PT-2026-52584

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description There are certificate policy and RFC 8446 compliance concerns due to the continued acceptance of SHA-1 and MD5 hashing algorithms during certificate processing...

UBUNTU-CVE-2026-12490

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port and not the tls-auth-port or over over TCP over the regular...

PT-2026-52594

Name of the Vulnerable Software and Affected Versions Apicurio Registry affected versions not specified Description A flaw exists where the WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, a user with...