AZL-112697 CVE-2026-77299 affecting package regexp 1.5-24

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

AZL-112711 CVE-2026-112910 affecting package python-filelock 3.20.3-4

filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because opennonreparsefd...

AZL-112705 CVE-2026-97371 affecting package ntopng 5.2.1-7

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpigetcustomcategorymatch writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist in src/IpAddress.cpp during packet dissection and host...

AZL-112702 CVE-2026-82413 affecting package ntopng 5.2.1-7

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept scanports from any authenticated session, including non-administrator users, while deployments with log...

AZL-112700 CVE-2026-61813 affecting package mod_security 2.9.7-8

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/httpsclient.cc sets libcurl CURLOPTSSLVERIFYHOST to 1 instead of the strict value 2L. Under...

AZL-112694 CVE-2026-122330 affecting package blosc 1.21.6-1

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2schunkgetslicebuffer in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via...

AZL-112655 CVE-2026-115715 affecting package rubygem-elasticsearch 8.9.0-1

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run...

AZL-112649 CVE-2026-115298 affecting package rubygem-elasticsearch 8.9.0-1

Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-level security can retrieve the value of a constantkeyword field that their rol...

AZL-112652 CVE-2026-115710 affecting package rubygem-elasticsearch 8.9.0-1

Use of Cache Containing Sensitive Information CWE-524 in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions...

AZL-112640 CVE-2026-120758 affecting package hdf5 1.14.6-6

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect unpins it on the final unprotect. When the metadata cache...

AZL-112637 CVE-2026-120757 affecting package hdf5 1.14.6-6

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Lexterntraverse in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen without validating the buffer against...

AZL-112634 CVE-2026-120756 affecting package hdf5 1.14.6-6

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Ochunkdeserialize in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header flags, and for version 2 object...

AZL-112661 CVE-2026-120755 affecting package hdf5 1.14.6-6

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Zfilterszip in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated...

AZL-112658 CVE-2026-120754 affecting package hdf5 1.14.6-6

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Zfilterscaleoffset in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5Dchunklock deliberately siz...

AZL-112646 CVE-2026-119741 affecting package rsync 3.5.1-1

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hashsearch in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak...

AZL-112643 CVE-2026-99270 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsktimerhandler. When TCP socket migration fails at inetehashinsert in reqsktimerhandler, we jump to the noownership: label and free the new reqsk immediately with reqskfree. Thus, we must stop the new...

AZL-112622 CVE-2026-99261 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs...

AZL-112625 CVE-2026-99262 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring/timeout: don't lose a cancel as io-wq arms a timeout An IORINGOPTIMEOUT run by io-wq, because of IOSQEASYNC, has the same problem as poll, futex and waitid. iowqsubmitwork looks at IOWQWORKCANCEL once, before it issues th...

AZL-112631 CVE-2026-99268 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring: wake ring pollers for local taskwork With IORINGSETUPDEFERTASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via...

AZL-112628 CVE-2026-99263 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring/poll: avoid retry wakeup loss when dropping ownership If a wakeup sets IOPOLLRETRYFLAG between the owning task consuming the existing instance of IOPOLLRETRYFLAG and the loop check of iopollcheckevents, then we stall on...

AZL-112610 CVE-2026-99254 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork asks each task which has used the ring to remove its tctx node, by taskwork, and repeats that until the list is empty. iotctxexitcb doesn't touch the node while...

AZL-112613 CVE-2026-99255 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks everywhere a request can be, and goes to sleep if it found nothing to...

AZL-112619 CVE-2026-99260 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfsnewattrflags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated...

AZL-112616 CVE-2026-99256 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rwsemaphore for backgroundworklock. Write locks on rwsemaphores have strict owner semantics, but there was no guarantee that the process that locked...

AZL-112598 CVE-2026-99246 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...

AZL-112607 CVE-2026-99251 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in initvpindex There is a retry loop in initvpindex where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HKTYPEMANAGEDIRQ...

AZL-112604 CVE-2026-99249 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: pidnamespace: make zappidnsprocesses freezable When the init of a pid namespace exits, zappidnsprocesses waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies...

AZL-112601 CVE-2026-99247 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers, tracingdisabled is left set to 1 and the global trace array events...

AZL-112592 CVE-2026-99243 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation task work iowqexitworkers cancels task work for queued worker creation with taskworkcancelmatch. That has a plain load of task-taskworks. ioqueueworkercreate adds the new entry an...

AZL-112595 CVE-2026-99245 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix keyrejectandlink race with keyring restriction The restrictlink check in keyrejectandlink is done before taking the keyring semaphore, racing with a concurrent keyringrestrict that installs the restriction while holding...

AZL-112682 CVE-2026-120831 affecting package libslirp 4.9.6-1

A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...

AZL-112679 CVE-2026-120830 affecting package libslirp 4.9.6-1

A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...

AZL-112526 CVE-2026-120689 affecting package hdf5 1.14.6-6

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5Biteratehelper in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5Bcachedeserialize when a node is first load...

AZL-112574 CVE-2026-99236 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

AZL-112577 CVE-2026-99240 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damoscommitquotagoal for zero targetvalue Patch series "mm/damon: move zero damos quota targetvalue handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API...

AZL-112571 CVE-2026-99235 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

AZL-112565 CVE-2026-99233 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

AZL-112568 CVE-2026-99234 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

AZL-112556 CVE-2026-99226 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

AZL-112562 CVE-2026-99229 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

AZL-112553 CVE-2026-99225 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...

AZL-112559 CVE-2026-99228 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...

AZL-112538 CVE-2026-99220 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

AZL-112550 CVE-2026-99224 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

AZL-112544 CVE-2026-99222 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

AZL-112547 CVE-2026-99223 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

AZL-112541 CVE-2026-99221 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

AZL-112532 CVE-2026-99218 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...

AZL-112529 CVE-2026-99217 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after schedcancelfork Reorder copyprocess cleanup so schedfork taking scxforkrwsem scxprefork is safe and isn't held around exiting files. Right now, a fork that fails while another thread...

AZL-112535 CVE-2026-99219 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...