DEBIAN-CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

UBUNTU-CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

SUSE CVE-2026-87825

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causi...

CVE-2026-55859

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

CVE-2026-55858

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The...

UBUNTU-CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-74365: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: Handle preemption in BTT lane acquisition BTT lanes serialize access to per-lane metadata and workspace state during BTT I/O. The btt-check unit test reports data mismatches during BTT writes due to a race in lane...

CVE-2026-29036

A flaw was found in cJSON, a JSON parser and generator. This vulnerability allows unauthenticated attackers to manipulate JSON Patch operations by supplying crafted JSON Pointer escape sequences. This can lead to silent corruption of data or the deletion of unintended keys, potentially bypassing...

Linux Distros Unpatched Vulnerability : CVE-2026-68330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailb...

SUSE CVE-2026-68330

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

CVE-2026-29036 cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-68330

A flaw was found in the Linux kernel's airoha network driver. This vulnerability arises from an incorrect configuration of Direct Memory Access DMA for the Network Processing Unit NPU mailbox buffer. Specifically, the system incorrectly maps the buffer for data transfer only to the device, even...

PT-2026-69730

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the airoha npu send msg function where the mailbox buffer is always mapped using DMA TO DEVICE. However, certain callers, such as airoha npu wlan msg get NPU OP GET an...

CVE-2026-68330: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...

mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculatedataframehash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local...

PYSEC-2026-3487 mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculatedataframehash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local...

mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculatedataframehash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local...