AZL-94007 CVE-2026-55971 affecting package thrift for versions less than 0.24.0-1

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-93977 CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94083 CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1

Out-of-bounds Read vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94217 CVE-2026-55969 affecting package influxdb for versions less than 2.7.5-20

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94232 CVE-2026-55969 affecting package kata-containers-cc for versions less than 3.15.0.aks0-20

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94160 CVE-2026-55969 affecting package kata-containers-preview 3.27.0~preview2-2

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-93986 CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1

Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94332 CVE-2026-55969 affecting package vitess for versions less than 19.0.4-12

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94317 CVE-2026-55969 affecting package telegraf 1.31.0-33

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-93992 CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, cglib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94320 CVE-2026-43871 affecting package telegraf for versions less than 1.31.0-26

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94214 CVE-2026-48586 affecting package influxdb for versions less than 2.7.5-20

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94166 CVE-2026-48586 affecting package kata-containers-preview 3.27.0~preview2-2

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94077 CVE-2026-48144 affecting package thrift for versions less than 0.24.0-1

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94004 CVE-2026-48145 affecting package thrift for versions less than 0.24.0-1

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94220 CVE-2026-43871 affecting package influxdb for versions less than 2.7.5-20

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94001 CVE-2026-48586 affecting package thrift for versions less than 0.24.0-1

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94329 CVE-2026-43871 affecting package vitess for versions less than 19.0.4-12

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94235 CVE-2026-43871 affecting package kata-containers-cc for versions less than 3.15.0.aks0-20

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94238 CVE-2026-48586 affecting package kata-containers-cc for versions less than 3.15.0.aks0-20

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94314 CVE-2026-48586 affecting package telegraf for versions less than 1.31.0-28

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-93989 CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94163 CVE-2026-43871 affecting package kata-containers-preview 3.27.0~preview2-2

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-93995 CVE-2026-43871 affecting package thrift for versions less than 0.24.0-1

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

AZL-94193 CVE-2026-17527 affecting package containerized-data-importer 1.62.0-8

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

AZL-94241 CVE-2026-17527 affecting package kubevirt 1.8.4-2

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

AZL-94244 CVE-2026-16554 affecting package libglvnd 1.7.0-3

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

AZL-94184 CVE-2026-16554 affecting package apparmor 3.1.7-1

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

AZL-93962 CVE-2026-64533 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fro...

AZL-93971 CVE-2026-64532 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In doaction's UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases, the memmove destination is Add2Ptre, le16tocpue-view.dataof...

AZL-93959 CVE-2026-64536 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...

AZL-93965 CVE-2026-64531 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

AZL-94010 CVE-2026-15928 affecting package xmlrpc-c 1.60.04-4

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

AZL-93957 CVE-2026-64530 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

AZL-93953 CVE-2024-14040 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-out of the involved nodes, and overall...

AZL-93803 CVE-2026-64525 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

AZL-93725 CVE-2026-64523 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

AZL-93563 CVE-2026-64513 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recompute CR8 intercept on PPR update The TPRTHRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject...

AZL-93885 CVE-2026-64511 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 "ACPI: NFIT: Install Notify handler before getting NFIT table", acpinfitprobe installs an ACPI notify handler for the NFIT device before checking t...

AZL-93608 CVE-2026-64514 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate mustwait writability check on ptepresent userfaultfdmustwait and userfaultfdhugemustwait read the PTE without taking the page table lock and then apply ptewrite / hugeptewrite to it. Those accessors decode bits...

AZL-93852 CVE-2026-64512 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg-accesswidth changes depending on the reg-spaceid type. Type ACPIADRSPACEPLATFORMCOMM uses accesswidth to indicate the PCC region, which can result in...

AZL-93419 CVE-2026-64510 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpinfitinit error cleanup If acpinfitinit fails after adding the acpidesc object to the acpidescs list, that object is never removed from that list because the acpinfitshutdown devm action is not added for...

AZL-93857 CVE-2026-64508 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

AZL-93809 CVE-2026-64507 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF...

AZL-93731 CVE-2026-64496 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with anoninodegetfd, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the calle...

AZL-93533 CVE-2026-64487 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser sndusbcaiaqtks4dispatch decodes the Traktor Kontrol S4 input stream in fixed 16-byte TKS4MSGBLOCKSIZE message blocks. On every iteration it advances buf a...

AZL-93750 CVE-2026-64482 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. sndgf1pcmvolumecontrol does not check the return value before dereferencing kctl-id.index, which can lead to a NULL pointer...

AZL-93728 CVE-2026-64478 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

AZL-93909 CVE-2026-64475 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

AZL-93431 CVE-2026-64470 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue...