ROS-20260728-73-0013

The vulnerability in Grafana relates to the lack of security measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-64539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

CVE-2026-64539

Linux kernel Bluetooth EIR code (eir_create_adv_data) has a stack-based OOB write vulnerability when prepending a 3-byte Flags AD to advertising data in a fixed-size 31-byte legacy buffer. If adv_data_len approaches the limit and the Flags structure is not fully accommodated, the code can memcpy ...

CVE-2026-64539 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eircreateadvdata builds the advertising data into a fixed-size buffer "size", 31 for the legacy path. It may prepend a 3-byte "Flags" AD structure LEADNOBREDR on an...

ROS-20260727-73-0020

A vulnerability in httpd related to a failure to implement measures to protect the structure of a web page. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20260727-73-0013

A vulnerability in apache-activemq related to a failure to implement measures to protect the structure of a web page. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-64346

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64332

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

CVE-2026-64529 crypto: qat - remove unused character device and IOCTLs

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qatadfctl with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public...

CVE-2026-64436 net: af_key: initialize alg_key_len for IPComp states

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

EUVD-2026-48890

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

openSUSE 16 Security Update : perl (openSUSE-SU-2026:21411-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21411-1 advisory. - CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date bsc1266361. - CVE-2026-8376:...

CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

CVE-2026-10822

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

The vulnerability of Adobe Experience Manager’s content and media data management system lies in the insufficient protection of website structures, which allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the Adobe Media Encoder application relates to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using the DOM...

The vulnerability of Adobe Experience Manager’s content and media data management system lies in the insufficient protection of website structures, which allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the Adobe Media Encoder application relates to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using the DOM...

PT-2026-63534

Name of the Vulnerable Software and Affected Versions Drupal Media Folders versions 0.0.0 through 1.0.8 Description Stored cross-site scripting XSS occurs because the module does not sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media...

The vulnerability of Windows Admin Center, related to the lack of measures taken to protect the website structure, allows attackers to perform spear-phishing attacks.

The vulnerability of the Windows Admin Center management tool is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

The vulnerability of the XML analysis mechanism in security systems and the Nessus vulnerability assessment tool allows attackers to execute arbitrary SQL queries.

The vulnerability of the XML analysis mechanism of the security system and the Nessus vulnerability assessment tool is related to the lack of measures taken to protect the SQL query structure during the processing of the nessus file. Exploiting this vulnerability allows an attacker to execute...