OSV-2026-610 Memcpy-param-overlap in htx_replace_blk_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504612570 Crash type: Memcpy-param-overlap Crash state: htxreplaceblkvalue httpreplaceheadervalue httpschemebasednormalize...

CVE-2026-6019: Improper Neutralization of Escape, Meta, or Control Sequences

http.cookies.Morsel.jsoutput returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the use of a hardcoded value for hdr2len, potentially leading to errors in response buffer management...

CVE-2026-35344: Unchecked Return Value

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directorie...

CVE-2026-35339: Incorrect Check of Function Return Value

The recursive mode -R of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 success even if error...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from undefined behavior during the processing of INTMIN by the BPF interpreter sdiv/smod. This...

CVE-2026-31525: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix undefined behavior in interpreter sdiv/smod for INTMIN The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs macro on s32 operands. The abs macro documentation include/linux/math.h explicitl...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013726)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013726 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: meson-gx: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore its...

PT-2026-34549

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description The js output function within http.cookies.Morsel returns an inline snippet that only escapes double quotes for JavaScript string context. It fails to neutralize the sequence, which is sensiti...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013536)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013536 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore its...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013734)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013734 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref due to drmmmodeconfiginit drmmmodeconfiginit will call...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013505)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013505 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udfgetfileshortad Check for overflow when computing alen in...

CVE-2026-41128

Craft CMS is a content management system CMS. In versions 5.6.0 through 5.9.14, the actionSavePermissions endpoint allows a user with only viewUsers permission to remove arbitrary users from all user groups. While saveUserGroups enforces per-group authorization for additions, it performs no...

BIT-VAULT-2026-3605 Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret...

GHSA-8Q4H-8CRM-5CVC

creationtimestamp| type| source ---|---|--- 2026-04-21 11:00:26+00:00| seen| https://bsky.app/profile/getpacketai.bsky.social/post/3mjytdcford24 2026-04-23 21:26:07+00:00| published-proof-of-concept| Telegram/wY3PGk1V7kusFG8GbDK0g0CtGhXXIm9UsDC-frBku-7BiY...

OpenEXR 输入验证错误漏洞

OpenEXR is an open standard for high dynamic range image HDR file format, open-sourced by the Academy Software Foundation. Versions 3.4.0 to 3.4.9 of OpenEXR contain a input validation vulnerability. This vulnerability stems from an integer overflow in the 32-bit signed integer bpl value of the...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011293)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011293 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: toshsd: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore its...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013092)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013092 advisory. In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alaudacheckmedia Syzbot got KMSAN to complain about acce...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006956)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006956 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninititialized value in 'ext4evictinode' Syzbot found the following issue:...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-012995)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-012995 advisory. In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in hfsplusdeletecat The syzbot reported issue in...