Linux Distros Unpatched Vulnerability : CVE-2026-44359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered ...

Amazon Linux 2023 : libipa_hbac, libipa_hbac-devel, libsss_autofs (ALAS2023-2026-1984)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1984 advisory. A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local...

Linux Distros Unpatched Vulnerability : CVE-2026-64139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix SID memory leak in setposixaclentriesdacl on overflow Commit 299f962c0b02 ksmbd: use checkaddoverflow to prevent u16 DACL size overflow added...

ALSA-2026:41894 Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29...

Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

Linux Distros Unpatched Vulnerability : CVE-2026-64177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock ma...

Linux Distros Unpatched Vulnerability : CVE-2026-63987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks t...

EUVD-2026-45875

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...

CVE-2026-44359

The CVE describes a flaw in Meshtastic’s GitHub workflow (main_matrix.yml) prior to version 2.7.21.1370b23 where pull_request_target could trigger jobs that check out attacker forks and execute attacker-controlled files with repository secrets and elevated GITHUB_TOKEN permissions. External PRs w...

CVE-2026-64177

CVE-2026-64177 is a Linux kernel vulnerability in the Phonet protocol (pep) handling where forwarding of skb to a child socket via sk_receive_skb() incorrectly acquires the child socket lock with BH enabled in the softirq path. The root cause is a BH state mismatch between softirq and process pat...

CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

CVE-2026-64129

CVE-2026-64129 affects the Linux kernel where, in migrate_vma_insert_huge_pmd_page within the memory management code, a spinlock leak could occur if check_stable_address_space() fails after pmd_lock() acquires the PMD spinlock. The path could jump to abort, bypassing the unlock, causing the PMD s...

CVE-2026-64027 net: shaper: rework the VALID marking (again)

In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking again Recent commit changed the semantics from NOTVALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing ...

CVE-2026-63989 bridge: Fix sleep in atomic context in netlink path

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in netlink path Since the introduction of the netlink configuration path for bridge ports in commit 25c71c75ac87 "bridge: bridge port parameters over netlink", brsetport was always called with...

CVE-2026-63986 ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsinfo: don't pass ERRPTR to genlmsgcancel on prepare failure The goto err label leads to: genlmsgcancelskb, ehdr; return ret; If ethnltsinfopreparedump failed, it has not started a genlmsg. There's nothing to cancel, an...

CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

OESA-2026-3043 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Exposure of Sensitive Information to an Unauthorized...

OESA-2026-3053 yelp security update

Yelp is the help viewer in GNOME. It natively views Mallard, DocBook, man, info, and HTML documents. It can locate documents according to the freedesktop.org help system specification. Security Fixes: A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation...