CVE-2026-63868

A flaw was found in the Linux kernel's Generic Attribute Registration Protocol GARP network component. A remote attacker could send specially crafted GARP attributes, leading to an unsigned integer underflow during attribute parsing. This underflow causes the system to incorrectly process attribu...

SUSE CVE-2026-63935

In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the samplingfrequency sysfs attribute trigge...

SUSE CVE-2026-64088

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative ttbufflen batadvorignode::ttbufflen was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. I...

SUSE CVE-2026-64089

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative lastchangesetlen batadvpivtt::lastchangesetlen len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative...

EulerOS Virtualization 2.10.0 : unbound (EulerOS-SA-2026-2872)

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead ...

glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...

CVE-2026-63768

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-63768

CVE-2026-63768 affects cal.diy up to version 6.2.0. The issue is an open redirect in the conferencing OAuth callback endpoint triggered by crafting malicious state parameters, exploiting an unsigned state parameter and the onErrorReturnTo field to silently redirect users from the trusted domain t...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

MGASA-2026-0284 Updated perl-Imager package fixes security vulnerabilities

The updated package fixes security vulnerabilities: The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim method is called on a crafted input image. CVE-2024-53901 Imager versions before 1.032 fo...

glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...

CVE-2026-63091

ProFTPD mod_sftp in versions before 1.3.9c and 1.3.10rc3 contains a signed integer overflow in the SCP size-record parser. An authenticated, low-privilege attacker can send a crafted file size (UINT64_MAX) to produce a negative off_t, convert to uint32_t, and trigger ~4 GB read length, causing th...

CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-63935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in writeraw Add a validation check for the...

CVE-2026-64161

In the Linux kernel, the following vulnerability has been resolved: net: ti: icssm-prueth: fix ethportsnode leak in probe The error path on ofpropertyreadu32 failure inside icssmpruethprobe returns without putting ethportsnode, which was acquired before the foreachchildofnode loop. Drop it before...

CVE-2026-64089

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative lastchangesetlen batadvpivtt::lastchangesetlen len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative...

CVE-2026-64088

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative ttbufflen batadvorignode::ttbufflen was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. I...

CVE-2026-63935

In the Linux kernel, the following vulnerability has been resolved: iio: adc: nxp-sar-adc: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero or a negative value to the samplingfrequency sysfs attribute trigge...