Security update for libXpm (moderate)

openSUSE security update: security update for libxpm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22056-1 Rating: moderate References: bsc1281669 Cross-References: CVE-2026-94287 CVSS scores: CVE-2026-94287 SUSE : 6.2...

Security update for gimp (important)

openSUSE security update: security update for gimp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22123-1 Rating: important References: bsc1277594 bsc1277618 bsc1277622 bsc1284473 bsc1284474 bsc1284475 Cross-References: CVE-2026-106061...

CVE-2026-98703: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

PT-2026-116768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TCP implementation where socket buffer skb collapsing can occur across boundaries in the retransmission rtx queue. When a switch to device encryption occurs, the t...

PT-2026-116611

Name of the Vulnerable Software and Affected Versions Schism Tracker versions prior to 20260524 Description A heap out-of-bounds write occurs in the fmt ult load song function within fmt/ult.c because the one-byte sample count is not clamped to MAX SAMPLES. A remote attacker can use a specially...

PT-2026-116616

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta decoder process stream and tta decoder process frame because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 wi...

PT-2026-116634

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model name. Attackers can register a persisted custom model through POST /v1/model registrations/model type with...

VulnCheck KEV: CVE-2026-33309

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 External Control of File Name, leading to the root architectural issue within LocalStorageService remaining unresolved. Because the underlying...

PT-2026-116892

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pac1934 ADC driver within the Industrial I/O IIO subsystem. A failure in checking for ACPI label duplication allows the process to reach a terminating-byte write,...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791971338)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791971338 advisory. - rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destinatio...

PT-2026-116609

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read text, read blob, COPY...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc (CENTOS8.4:CLSA-2026:1784277735)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784277735 advisory. - In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK...

PT-2026-117086

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-pcache component where the cache key decode function retrieves a key's logical offset from the cache device. This offset is subsequently used to index the req k...

PT-2026-117055

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA line6 driver where playback packets are not validated against the allocated buffer size. The submit audio out urb function calculates the frame count based on...

PT-2026-117046

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ath9k htc wifi driver where the hif usb tx function fails to limit the cumulative byte length of aggregated frames. The function dequeues up to 20 frames into a...

PT-2026-116789

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 implementation where the dst dev overhead function does not allocate sufficient headroom for the MAC header. When using seg6, ioam6, and rpl lwtunnels, the...

Linux Distros Unpatched Vulnerability : CVE-2026-98827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting th...

PT-2026-116974

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vcc send ctl function where a stack-allocated struct vio vcc packet is partially initialized. This leaves the tag.stype env field uninitialized before it is...

CVE-2026-98568: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...