CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-18664

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-18664 Wrong interpretation of ACL ranges

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-18664: Improper Access Control

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

USN-8630-5: Linux kernel (Raspberry Pi) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Mellanox network drivers; - File systems infrastructur...

CVE-2026-59981

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::ro...

Wazuh Server 4.6.0 < 4.14.6 SQL Injection (CVE-2026-49392)

The version of Wazuh Server on the remote host is at least 4.6.0 and prior to 4.14.6. It is, therefore, affected by a SQL injection vulnerability: - DB::getFile and DB::searchFile concatenate a monitored file path into SQLite row filters without proper escaping on non-Windows systems. A local use...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: 1. fs/proc/taskmmu: Fixed the race condition in makeuffdwphugepte where updates to the “Dirty” or “Accessed” status of a page might be lost when PAGEMAPSCAN writes-protects a HUGETLB PTE. 2. fs/proc/taskmmu: The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ext4: Fix for the fast commit wait/wake bit mapping on 64-bit systems. On 64-bit systems, ext4’s dynamic inode states are stored in the upper half of the iFlags field. The ext4testinodestate function applies a +32 offset to...

CVE-2026-19671

creationtimestamp| type| source ---|---|--- 2026-08-21 20:15:16+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-cisa-security-advisory-av26-841...

CVE-2026-19670

creationtimestamp| type| source ---|---|--- 2026-08-21 20:15:14+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-cisa-security-advisory-av26-841 2026-08-24 16:02:03+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mttohpmzm52x...

Security Bulletin: This Power System update is being released to address CVE-2026-19234

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

Security Bulletin: This Power System update is being released to address CVE-2026-17429

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted...

Security Bulletin: This Power System update is being released to address CVE-2026-16930

Summary Power Systems Firmware is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions,...

Security Bulletin: This Power System update is being released to address CVE-2026-19321

Summary Power Systems Firmware is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers that should be inaccessible to the service processor. Successful...

CVE-2026-48750

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-48754

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

USN-8644-2 linux-gcp, linux-gcp-4.15, linux-gcp-fips vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - File systems infrastructure; - OCFS2 file system; - B.A.T.M.A.N. meshing protocol; - SCTP protocol; - TIPC protocol...