Chromium CVE-2026-95329: Out of bounds write in WebGL

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95304: Out of bounds write in V8

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95357: Out of bounds write in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-95322: Out of bounds write in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-93834

A use-after-free vulnerability exists in the QEMU 9pfs subsystem due to a race condition between the main thread and a worker thread. When processing concurrent Tlcreate and Twalk requests, a malicious guest user can craft a fid path containing stale heap data . This allows the attacker to bypass...

CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

EUVD-2026-87092

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-80431 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

EUVD-2026-87088

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-80431

The kitty terminal (versions 0.40.0 to before 0.49.0 ) contains an out-of-bounds write vulnerability in the natural width branch of the text sizing protocol. The root cause is located in screen_handle_multicell_command() within kitty/screen.c, where the application appends codepoints to a fixed-s...

CVE-2026-80431

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-80431 Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-80431

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

[SECURITY] [DLA 4795-1] openssl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4795-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout September 25, 2026 https://wiki.debian.org/LTS -...

BIT-CONSUL-2026-87090 Consul vulnerable to an authorization bypass in the catalog node-write path

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node...

AZL-104727 CVE-2026-98142 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

DEBIAN-CVE-2026-98142

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

CVE-2026-98142

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

DEBIAN-CVE-2026-98119

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...