UBUNTU-CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

PT-2026-65268

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote attacker may be able to bypass network filters...

PT-2026-65279

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versio...

Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / almalinux-8.10.z...

Erlang/OTP -- relative path traversal in the zip module

The Erlang/OTP team reports: Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory...

PT-2026-65206

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description An out-of-bounds write issue exists where an...

PT-2026-65208

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description An integer overflow occurs during the processing of a...

PT-2026-65289

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versio...

UBUNTU-CVE-2026-8348

hw/9pfs: add xattr FID limit to prevent memory exhaustion...

UBUNTU-CVE-2026-64237

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature which resides at the end of the firmware blob before accessing them to...

python313-urwid-4.0.5-1.1 on GA media (moderate)

python313-urwid-4.0.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11356-1 Rating: moderate Cross-References: CVE-2026-9323 CVSS scores: CVE-2026-9323 SUSE : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can no...

Updated graphite2 packages fix a security vulnerability

The updated packages fix a security vulnerability: Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range. CVE-2026-50593...

SUSE CVE-2026-64309

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

SUSE CVE-2026-64381

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

SUSE CVE-2026-64385

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...

SUSE CVE-2026-64395

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTLDUPLICATEEXTENTSTOFILE passes the source file directly to vfsclonefilerange or vfscopyfilerange without checking the SMB access mask granted to the source handle. A...

SUSE CVE-2026-64444

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

SUSE CVE-2026-64518

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcpaoestablishedkey. lockdepsockisheld was added in tcpaoestablishedkey by the cited commit. It can be called from tcpv46timewaitack with twsk. Since it does not have sk-sklock, the lockd...

CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

CVE-2026-64287

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU flushhypvcpu copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use usedlrs as their loop bound and expect it to...