Linux Distros Unpatched Vulnerability : CVE-2026-93821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: altera: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent...

Linux Distros Unpatched Vulnerability : CVE-2026-93822

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: iproc: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent...

Linux Distros Unpatched Vulnerability : CVE-2026-93818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: plda: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent...

CVE-2026-93814

In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing...

CVE-2026-93816: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate inline dentry name lengths before conversion Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted imag...

SUSE CVE-2026-92162

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

SUSE CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

SUSE CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update

A flaw was found in the libceph component of the Linux kernel. During an authorizer update, if the authorizer is rebuilt, a stale pointer to a freed memory region can be retained. A remote attacker could exploit this by triggering a specific network reconnection, leading to a use-after-free...

kernel: Linux kernel: libceph null pointer dereference leads to denial of service

A flaw was found in libceph, a component of the Linux kernel. When processing a malformed CRUSH map, if a parent bucket's name exists but its type is missing, a null pointer dereference can occur. This issue can lead to a system crash, resulting in a Denial of Service DoS...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-77414

A flaw was found in JSONata, a JSON query and transformation language. This vulnerability allows a remote attacker to execute arbitrary code with the privileges of the host process. By crafting malicious JSONata expressions, an attacker can bypass a security check, gaining unauthorized access to...

CVE-2026-84724

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-84724

An argument-injection flaw exists in the Ansible Automation Platform automation-controller system-job subsystem. The issue occurs because the system-job template launch endpoint fails to perform integer validation on a user-supplied "days" variable . Consequently, the dispatcher flattens the mana...

EUVD-2026-85616

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-84724

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-77601

OpenC3 COSMOS versions 5.12.0 through 7.3.0 are vulnerable to authenticated OS command injection via the pypi_url setting. An attacker can use the set_setting API method (POST /openc3-api/api) to write a malicious URL containing shell metacharacters. When a plugin with Python dependencies is inst...