DEBIAN-CVE-2026-86095

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

DEBIAN-CVE-2026-80897

In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator preparation failure netfspreparereaditerator batches readahead folios in putbatch so that the folio references can be dropped after the I/O iterator has been prepared. If...

DEBIAN-CVE-2026-80882

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

DEBIAN-CVE-2026-80860

In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrupt and resend After commit f8fce75fedf7 "fuse: clear intrentry in fuseresend and fuseremovependingreq" the WARNON!listempty&req-intrentry in fuserequestfree still triggers due to the following race: ...

DEBIAN-CVE-2026-80810

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...

DEBIAN-CVE-2026-80761

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

DEBIAN-CVE-2026-84968

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...

DEBIAN-CVE-2026-80730

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERRPTR to kthreadstop In testringbuffer's outfree cleanup loop, the check !rbthreadscpu only catches NULL entries and misses entries that hold an ERRPTR. rbthreads is static, so unassigned slots are...

DEBIAN-CVE-2026-65107

Bulletin has no description...

DEBIAN-CVE-2026-65109

Bulletin has no description...

DEBIAN-CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

DEBIAN-CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject...

DEBIAN-CVE-2026-61404

Bulletin has no description...

DEBIAN-CVE-2026-50624

Bulletin has no description...

DEBIAN-CVE-2026-40204

None None None No publicly available exploits are known...

DEBIAN-CVE-2026-80660

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ unregister sysfs devices outside occ lock occactivefalse and occshutdown unregister sysfs-backed devices while occ-lock is held. hwmondeviceunregister and sysfsremovegroup can wait for active sysfs callbacks to drain,...

DEBIAN-CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

DEBIAN-CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

DEBIAN-CVE-2026-80594

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...

DEBIAN-CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP respons...

DEBIAN-CVE-2026-47884

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

DEBIAN-CVE-2026-80546

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

DEBIAN-CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

DEBIAN-CVE-2026-74747

In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent...

DEBIAN-CVE-2026-19401

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

DEBIAN-CVE-2026-79781

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

DEBIAN-CVE-2026-79769

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

DEBIAN-CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

DEBIAN-CVE-2026-74652

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

DEBIAN-CVE-2026-63310

Bulletin has no description...

DEBIAN-CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

DEBIAN-CVE-2026-74580

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

DEBIAN-CVE-2026-74583

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4filter pointers indexed by id, iif. The reader route4classify populates this cache via...

DEBIAN-CVE-2026-70651

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height while loading a crafted multi-page TIFF through VipsForeignLoadMagick. The vulnerable calculations i...

DEBIAN-CVE-2026-70652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...

DEBIAN-CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

DEBIAN-CVE-2026-73256

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...

DEBIAN-CVE-2026-73254

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

DEBIAN-CVE-2026-54770

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin strips leading C0 control characters and spaces. An attacker-controlled valu...

DEBIAN-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

DEBIAN-CVE-2026-65609

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

DEBIAN-CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

DEBIAN-CVE-2026-54552

sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with uid set to an unprivileged user, the child changes its UID but can retain the paren...

DEBIAN-CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

DEBIAN-CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

DEBIAN-CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

DEBIAN-CVE-2026-74518

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocatefileregionentries allocatefileregionentries tops up resv-regioncache with freshly allocated fileregion descriptors. The allocation uses GFPKERNEL, so resv-lock is dropped around it: the...

DEBIAN-CVE-2026-74480

In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group brmulticastleavegroup iterates mp-ports with pp = &p-next in its fast-leave path. After brmulticastdelpg removes p, continuing the loop advances pp through the deleted entr...

DEBIAN-CVE-2026-74388

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data The OSS sequencer processes the input MIDI bytes into a sequencer event to be dispatched later in sndseqossmidiputc called from sndseqossprocessevent. When it's ...

DEBIAN-CVE-2026-74338

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to lo...