CLSA-2026-1787732795 Fix CVE(s): CVE-2020-23804, CVE-2025-32365

SECURITY UPDATE: out-of-bounds read in JBIG2Bitmap::combine JBIG2Stream.cc via a crafted JBIG2 stream, from a misplaced isOk check - debian/patches/CVE-2025-32365.patch: add the isOk guard at the top of JBIG2Bitmap::combine so every caller is protected against out-of-bounds reads on a not-OK bitm...

PT-2026-82089

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, bus load reads the number of bus handles from the file attribute "bus handles" using attribute num data without validating an uppe...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: hivex (UTSA-2026-093163)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093163 advisory. A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry hive file, which would cause hivex to recursively...

CVE-2026-79902: Integer Overflow or Wraparound

A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array VLA on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098774)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098774 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a...

Linux Distros Unpatched Vulnerability : CVE-2026-79902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array VLA o...

CVE-2026-80186

CVE-2026-80186 is a stack-based buffer overflow in BlueZ , the Linux Bluetooth protocol stack, specifically in the name2utf8 function. A remote attacker within Bluetooth radio range can send a crafted Extended Inquiry Response (EIR) packet that triggers the overflow when the target device perform...

CVE-2026-80186 Bluez: stack overflow in name2utf8 causes dos and potential code execution

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

CVE-2026-80186 Bluez: stack overflow in name2utf8 causes dos and potential code execution

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input through the built-in coerceString and coerceBool scalar coercion functions in scalars.go. An attacker can trigger request handling errors or crash the process by supplying a scalar variable...

CVE-2026-80051

github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...

CVE-2026-80051

github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...

CVE-2026-80051

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions in scalars.go accept input whose type does not match the declared String , ID , or Boolean scalar instead of ra...

EUVD-2026-65681

github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...

CVE-2026-80051

github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...

CVE-2026-80051

github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...

CVE-2026-80051

github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...

K000163080: Linux kernel vulnerability CVE-2026-53267

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre ty...

PT-2026-81472

github.com/graphql-go/graphql GraphQL for Go through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions scalars.go accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising t...

TencentOS Server 4: cpio (TSSA-2026:0856)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0856 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...