CVE-2026-65816: Use of Incorrectly-Resolved Name or Reference

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-72315

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO Commit c68337442f03 "cifs: Fix busy dentry used after unmounting" fixed the issue in cifs where deferred close of a file led to a dentry reference count not being released...

CVE-2026-72269

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafbprobe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafbvbeinit is not freed in some error paths. Fix this by updating the goto label...

CVE-2026-72022

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

PT-2026-70947

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An uninitialized memory read exists in the handle get version reply function. The issue occurs because the function uses msg-front alloc len as the decode boundary for MON GET VERSION...

Use of Incorrectly-Resolved Name or Reference

Overview Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the decodepointerinplace function. An attacker can modify or delete unintended object keys by submitting crafted JSON Patch input containing malicious escape sequences in patch paths,...

Release Information for Veeam Recovery Orchestrator 13 and Updates

Veeam Recovery Orchestrator 13 Releases 13.1.0.483 2026-07-29 Embedded component versions: Veeam Backup & Replication 13.1.0.411, Veeam ONE 13.1.0.7034 Release Notes What's New 13.0.3.26 2026-08-28 Embedded component versions: Veeam Backup & Replication 13.0.3.63, Veeam ONE 13.0.2.7159 Release...

Important: kernel-livepatch-6.18.36-69.134

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Vulnerabilities Resolved in Veeam Service Provider Console 9.3

All vulnerabilities documented in this article were resolved in Veeam Service Provider Console 9.3.0.35057. Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure...

CVE-2026-64558 s390/pkey: Check length in pkey_pckmo handler implementation

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

CVE-2026-64558

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

CVE-2026-54660: Exposure of Sensitive Information to an Unauthorized Actor

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54663: Improper Input Validation

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-64252

In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations calling the initial console output handler from a kernel thread other than the initial one will result in a situation where the stack has...

CVE-2026-64250

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stopthiscpu This is a port of MIPS commit 9f3f3bdc6d9dac1 "MIPS: smp: report dying CPU to RCU in stopthiscpu". smpsendstop parks all secondary CPUs in stopthiscpu. And the function marks the...

CVE-2026-64247

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank the TLFS allows for a maximum o...

CVE-2026-64240

In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f "media: rc: igorplugusb: heed coherency rules" changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA...

CVE-2026-64236

In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCII2CDEFAULTBUSFREQ. However, this macro was defined in kHz 100,...

CVE-2026-64228

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

CVE-2026-64227

In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPICOMPANION against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely on...