4308 matches found
UBUNTU-CVE-2026-80790
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in LS IOD error path nvmetfcalloclsiodlist advances iod while initializing the LS IOD array. If an rqstbuf allocation or response buffer DMA mapping fails, the unwind loop decrements iod past the start ...
UBUNTU-CVE-2026-80815
In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...
UBUNTU-CVE-2026-80782
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc-input if no input is claimed magicmouseinputmapping caches the first hidinput's inputdev in msc-input while the report descriptor is parsed, and the rest of the driver treats a non-NULL...
UBUNTU-CVE-2026-80830
In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usbwakeupnotification Add a spin lock to usbwakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver as it calls this function from an IRQ and...
UBUNTU-CVE-2026-80763
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...
UBUNTU-CVE-2026-80774
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hidisusb check tousbinterface can only be used on a hiddevice whose parent is really USB; uhid can create devices that identify as being on BUSUSB, but don't actually have a USB parent. Fix the use of...
UBUNTU-CVE-2026-80764
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix LE list UAF on reset hciccreset clears the LE accept and resolving lists without taking hdev-lock. Other command-complete handlers serialize updates to these lists with that lock, and the debugfs readers...
UBUNTU-CVE-2026-80765
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTHHIDINITIALDEVICEINFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsconreceivedeviceinfo trusts...
UBUNTU-CVE-2026-80855
In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the outinodeunlock label. But when fusedaxbreaklayouts fails, the goto...
UBUNTU-CVE-2026-80784
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...
UBUNTU-CVE-2026-80798
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a frame is at least LLCPHEADERSIZE bytes before parsing it. nfcllcprxskb...
UBUNTU-CVE-2026-80840
In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control block on IPIP decapsulation End.DX4 and End.DT4 decapsulate an IPv4 packet through decapandvalidate and send it directly to IPv4 routing. The inner packet therefore bypasses iprcvcore, which normall...
UBUNTU-CVE-2026-80825
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usbsdiotxprepareskb mt7925usbsdiotxprepareskb pushes a TX descriptor and a USB header onto every skb and assumes the headroom for them is already there. That holds for locally generated...
UBUNTU-CVE-2026-80767
In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enablesensor enablesensorstore can call setpowerreportstate, which dereferences sensorinst-powerstate and sensorinst-reportstate. These pointers refer to entries in sensorinst-fields...
UBUNTU-CVE-2026-80800
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connectsn TLV walk to the skb Commit 27256cdb290e "nfc: llcp: bound SNL TLV parsing to the skb and add length checks" fixed the unbounded TLV walk in nfcllcprecvsnl, and commit d8bd2dedbde5 "nfc: llcp: fix OO...
UBUNTU-CVE-2026-80861
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if the controller is inaccessible xhcigensetup locates the operational registers using the capability length read from the very first register: xhci-opregs = hcd-regs +...
UBUNTU-CVE-2026-80814
In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...
UBUNTU-CVE-2026-73030
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...
UBUNTU-CVE-2026-63030
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
UBUNTU-CVE-2026-48820
CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::getElementFileName does not check that the resolved element path is within the application/plugin view template paths...
UBUNTU-CVE-2026-48188
An improper Input Validation vulnerability in OTRS or OTRS Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NOBACKSLASHESCAPES SQL mode...
UBUNTU-CVE-2025-30153
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...
UBUNTU-CVE-2026-108119
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...
UBUNTU-CVE-2026-95210
Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions...
UBUNTU-CVE-2026-108546
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...
UBUNTU-CVE-2026-44035
Uncontrolled recursion in DcmDicomDir::moveRecordToTree in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset o...
UBUNTU-CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
UBUNTU-CVE-2026-108981
ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...
UBUNTU-CVE-2026-98378
In the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpflinkprime inserts a link into linkidr before anoninodegetfile succeeds and before bpflinksettle publishes the ID in link-id. bpflinkbyid treats such an ID-zero link as unsettled, but...
UBUNTU-CVE-2026-92705
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by Automation Scripts metadata in ASS subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted AS...
UBUNTU-CVE-2026-107325
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...
UBUNTU-CVE-2026-106438
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application,...
UBUNTU-CVE-2026-106428
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...
UBUNTU-CVE-2026-106435
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...
UBUNTU-CVE-2026-106434
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application...
UBUNTU-CVE-2026-107695
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parseplaylist accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that...
UBUNTU-CVE-2026-107660
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tlsopen of libavformat/tlsmbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issu...
UBUNTU-CVE-2026-108978
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9...
UBUNTU-CVE-2026-105516
Unknown description...
UBUNTU-CVE-2026-105517
Unknown description...
UBUNTU-CVE-2026-107284
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installati...
UBUNTU-CVE-2026-42532
A path traversal vulnerability exists in the EmailSheet extractparts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability...
UBUNTU-CVE-2026-107282
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original...
UBUNTU-CVE-2026-106569
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32...
UBUNTU-CVE-2026-106575
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...
UBUNTU-CVE-2026-98374
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmitskbhint in tcpsendsynack When tcpsendsynack replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcprtxqueueunlinkandfree and only repairs...
UBUNTU-CVE-2026-87890
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9,...
UBUNTU-CVE-2026-106122
The RabbitMQ Java client library allows Java and JVM-based application...