CVE-2026-64391 ksmbd: use opener credentials for ADS I/O

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

PT-2026-64729

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

Linux Distros Unpatched Vulnerability : CVE-2026-64507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flus...

Linux Distros Unpatched Vulnerability : CVE-2026-64508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those...

CVE-2026-48037

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0...

SUSE-SU-2026:22942-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...

The vulnerability of the hdm_probe() function in the drivers/most/most_usb.c module of the Linux kernel allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hdmprobe function in the drivers/most/mostusb.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

EUVD-2026-43645

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

CVE-2026-50252

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

CVE-2026-50252 Possible cache poisoning attack by mapping source port population per thread

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined...

The vulnerability of the vti6_tnl_xmit() function in the net/ipv6/ip6_vti.c module of the Linux operating system allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vti6tnlxmit function in the net/ipv6/ip6vti.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

GHSA-2M9V-5Q2G-58VQ Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

SUSE-SU-2026:3160-1 Security update for python-tornado

This update for python-tornado fixes the following issues: - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse bsc1269012...

EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-2816)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers.libcurl features a pool of recent connections so th...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2723)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy...

EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-2769)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same...

The vulnerability of the mptcp_pm_del_add_timer() function in the net/mptcp/pm.c module of the MPTCP protocol implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mptcppmdeladdtimer function in the net/mptcp/pm.c module of the MPTCP protocol implementation in Linux operating systems is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2026-2847)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers.libcurl features a pool of recent connections so th...

CVE-2026-57494 AgenticMail: Cross-agent task authorization bypass in AgenticMail API

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...