CVE-2026-58413

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.restoreenv, backupId computes the backup path with joinenvDir, '.backups', backupId and only checks that this path exists. It does not resolve the result or verify that it remains under...

CVE-2026-58481 Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling pa...

Important: Red Hat Security Advisory: Satellite 6.16.11 Async Update

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

SUSE-SU-2026:22800-1 Security update for containerd

This update for containerd fixes the following issues - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service bsc1262266...

CVE-2026-64056

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

CVE-2026-64084

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 cap PDIO scan in getmultiple at ADM1266PDIONR adm1266gpiogetmultiple iterates the PDIO portion of the caller-supplied mask using foreachsetbitfromgpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS ... where...

PT-2026-61667

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.221 Description An unauthenticated remote attacker can download attachments created by older versions of the software. This occurs because the attachment download route skips token authentication when the token...

PT-2026-61716

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

PT-2026-61721

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.19.0 Apache MINA SSHD versions prior to 3.0.0-M5 Description Improper input validation in the sshd-git component of Apache MINA SSHD, specifically within the GitPgmCommandFactory, allows an authenticated SS...

CVE-2026-63880

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lock leak on ENOMEM in AMDGPUGEMOPGETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO branch of amdgpugemopioctl holds three cleanup-tracked resources before calling kvcalloc: the drmgemobject reference from...

CVE-2026-64062

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfsadvancewritethrough to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until t...

UBUNTU-CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-63942

In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not...

CVE-2026-64066

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued subrequest fails...

CVE-2026-64068

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfsretryreadsubrequests and netfsretrywritestream to take the appropriate lock when adding extra subrequests into stream-subrequests...

CVE-2026-53367

In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly saving and reusing the audited vector computed by avcauditrequired rather than recomputing based on the currently requested permissions and distinguishing the...

UBUNTU-CVE-2026-53369

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

UBUNTU-CVE-2026-64036

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

UBUNTU-CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

UBUNTU-CVE-2026-63999

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indirtable and hkey leak on getrxfh failure rssprepareget allocates the indirection table and hash key buffer via rssgetdataalloc, then calls ops-getrxfh to populate them. If getrxfh fails, the function returns ...