CVE-2026-31413: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybeforkscalars for BPFOR maybeforkscalars is called for both BPFAND and BPFOR when the source operand is a constant. When dst has signed range -1, 0, it forks the verifier state: the pushed pa...

OESA-2026-1857 firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setters, setZoneSettings2 and...

OESA-2026-1856 firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setters, setZoneSettings2 and...

OESA-2026-1859 firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus Desktop Bus setters, setZoneSettings2 and...

RockyLinux 8 : kernel-rt (RLSA-2026:6572)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:6572 advisory. kernel: nouveau: fix instmem race condition around ptr stores CVE-2024-26984 kernel: scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecoun...

Step CA affected by an index out of bounds panic in TPM attestation EKU validation

Summary An attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key AK certificate with an empty Extended Key Usage EKU extension during TPM device attestation. Details When processing a device-attest-01 ACME challenge using TPM attestation, Step CA...

nodejs: Nodejs filesystem permissions bypass

A file access flaw has been discovered in NodeJS. A file's access and modification timestamps to be changed via futimes even when the process has only read permissions. Unlike utimes, futimes does not apply the expected write-permission checks, which means file metadata can be modified in read-on...

golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling

A flaw was found in Node.js. This vulnerability in the TLS Transport Layer Security hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose...

CVE-2026-34943

A flaw was found in Wasmtime, a runtime for WebAssembly. A malicious guest can exploit an issue where a flags-typed component model value, containing unexpected bit settings, causes the host system to panic during processing. This vulnerability can lead to a Denial of Service DoS, rendering the...

CVE-2026-35645

OpenClaw is affected by a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function, which uses a synthetic operator.admin runtime scope. OpenClaw versions before 2026.3.25 are vulnerable to triggering session deletion to execute privileged operations with ...

nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions

A flaw was found in V8's string hashing mechanism within Node.js. A remote attacker can exploit this vulnerability by crafting requests containing integer-like strings. These specially crafted strings cause predictable hash collisions in V8's internal string table, particularly when processed by...

EUVD-2026-21029

Wasmtime has use-after-free bug after cloning wasmtime::Linker...

DEBIAN-CVE-2026-35195

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This...

amaranth-yosys (0.40.0.0.post98), devcycle-python-server-sdk (>=3.6.1, <=3.10.0) +1 more potentially affected by CVE-2026-34983 via wasmtime (23.0.0)

wasmtime PYPI version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.40.0.0.post98 - devcycle-python-server-sdk =3.6.1, =3.10.0 - yowasp-runtime 1.63.0 Source cves: CVE-2026-34983 Source advisory...

amaranth-yosys (0.25.0.0.post73), one-sdk (>=1.0.0b0, <=1.0.0b7) +2 more potentially affected by CVE-2026-34983 via wasmtime (10.0.1)

wasmtime PYPI version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post73 - one-sdk =1.0.0b0, =0.2.0, =1.23.0, =1.25.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.25.0.0.post74), yowasp-runtime (>=1.28.0, <=1.31.0) potentially affected by CVE-2026-34983 via wasmtime (11.0.0)

wasmtime PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post74 - yowasp-runtime =1.28.0, =1.31.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.25.0.0.post78), yowasp-runtime (>=1.41.0, <=1.42.0) potentially affected by CVE-2026-34983 via wasmtime (14.0.0)

wasmtime PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post78 - yowasp-runtime =1.41.0, =1.42.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

yowasp-runtime (1.49.0) potentially affected by CVE-2026-34983 via wasmtime (16.0.0)

wasmtime PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - yowasp-runtime 1.49.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (>=0.37.0.59.post85, <=0.38.0.0.post86), yowasp-runtime (1.50.0) potentially affected by CVE-2026-34983 via wasmtime (17.0.1)

wasmtime PYPI version 17.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys =0.37.0.59.post85, =0.38.0.0.post86 - yowasp-runtime 1.50.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...