Linux Distros Unpatched Vulnerability : CVE-2026-111105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

Linux Distros Unpatched Vulnerability : CVE-2026-110715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating ...

libX11 -- multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-88806: Out-of-bounds write vulnerability in libX11's XKB X Keyboard Extension action parser CVE-2026-94283: Out-of-bounds read...

libXpm -- vulnerability

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-94287: Denial of service via unsigned underflow in libXpm's write path...

Rocky Linux 9 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc Multiple Vulnerabilities (crlsa-2026_83553)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683553 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript: ghostscrip...

Rocky Linux 8 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc Multiple Vulnerabilities (crlsa-2026_83552)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683552 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript: ghostscrip...

Rocky Linux 10.2 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc Multiple Vulnerabilities (crlsa-2026_83551)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683551 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript:...

CVE-2026-67407

A flaw was found in rabbitmq-server. Due to improper regular expression character escaping, topic permission templates for Message Queuing Telemetry Transport MQTT clients fail to sanitize hyphen characters. An authenticated, low-privileged attacker controlling their client identifier can exploit...

[slackware-security] libXpm

New libXpm packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libXpm-3.5.20-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: Denial of service via unsigned underflow in libXpm's...

CVE-2026-111151

A flaw was found in OpenJPH. This vulnerability allows an attacker to cause a Denial of Service DoS and memory corruption by tricking a user or application into processing a crafted image file. When the High-Throughput JPEG 2000 HTJ2K decoder processes single-row image blocks, an out-of-bounds...

CVE-2026-111275

A flaw was found in nifticlib. This vulnerability can result in a Denial of Service DoS or memory corruption when an application processes a specially crafted NIfTI-2 image file. Due to missing range validation on dimension header values, an attacker could supply a malicious file that triggers a...

CVE-2026-111105

A flaw was found in rlottie. This vulnerability allows remote attackers to execute arbitrary code due to improper validation of user-supplied data, which can cause an out-of-bounds write before the start of an allocated buffer. Successful exploitation requires user interaction, such as convincing...

CVE-2026-110654

A flaw was found in zvbi. An out-of-bounds write vulnerability in the Teletext decoder allows an attacker to cause a Denial of Service DoS and memory corruption by supplying a specially crafted Teletext stream. When the application decodes the malicious stream containing unvalidated Dynamically...

CVE-2026-70197

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthenticated remote attacker to execute arbitrary code over the network. By sending specially crafted input to an affected application, an attacker can corrupt system memory and compromise the host environment...

OPENSUSE-SU-2026:22123-1 Security update for gimp

This update for gimp fixes the following issues: Changes in gimp: - CVE-2026-106061: plug-ins: Bound allocation for XMC import bsc1284473 - CVE-2026-106062: plug-ins/file-dds: fix out of bounds write bsc1284474 - CVE-2026-106063: plug-ins: Add bounds checks for DICOM export bsc1284475 -...

CLSA-2026-1792177938 tigervnc: Fix of 27 CVEs

CVE-2026-50264: fix out-of-bounds heap write in DRI2 DRIGetBuffers; carried by xorg-x11-server-source = 1.20.4-99.el79.tuxcare.els14, no local patch...

CVE-2026-111643

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...

CVE-2026-111627

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOTUSER administrators to perform write actions while impersonating the protected ROOTUSER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never...

CVE-2026-111621

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111643 Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...