CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

CVE-2026-64271

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and t...

CVE-2026-45383

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-64007

In the Linux kernel, the following vulnerability has been resolved: n...

CVE-2026-63876

In the Linux kernel, the following vulnerability has been resolved: s...

CVE-2025-71313 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

CVE-2026-46210 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

GHSA-W776-5FWP-835Q vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

CVE-2023-54365 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

os: golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

GHSA-V722-58F9-VCJ4 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-qemu-melange, linux-gcp...

CVE-2026-53253 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-qemu-melange, linux-gcp...

GHSA-V68W-64JW-RFJJ vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-55238

Unknown description...

CVE-2026-53131 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu-melange, linux-azure, linux-aws, linux-vmware, linux-qemu...

pip: pip: Incorrect file installation due to improper archive handling

A flaw was found in pip. This vulnerability occurs because pip incorrectly processes concatenated tar and ZIP files as ZIP files, regardless of their true format. This improper handling can lead to confusing installation behavior, potentially causing the installation of unintended or 'incorrect'...

CVE-2026-55380

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile.open read image dimensions from the GD 2.x header and stored them in self.size without calling Image.decompressionbombcheck, allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This iss...

CVE-2026-8924

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains...

CVE-2026-54886

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handledata/4 function in sshsftpd contains a catch-all clause that accepts channel data of any type. When...