AZL-41294 CVE-2018-1999024 affecting package numpy for versions less than 1.26.3-4

MathJax version prior to version 2.7.4 contains a Cross Site Scripting XSS vulnerability in the \unicode macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processe...

AZL-6453 CVE-2018-13420 affecting package gperftools for versions less than 2.7-4

Google gperftools 2.7 has a memory leak in mallocextension.cc, related to MallocExtension::Register and InitModule. NOTE: the software maintainer indicates that this is not a bug; it is only a false-positive report from the LeakSanitizer program...

AZL-43813 CVE-2015-2158 affecting package openjpeg2 2.3.1-12

Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted PNG file...

AZL-12122 CVE-2017-11548 affecting package libao 1.2.0-24

The tokenizematrix function in audioout.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service memory corruption via a crafted MP3 file...

AZL-6622 CVE-2017-3610 affecting package libdb for versions less than 5.3.28-7

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

AZL-45024 CVE-2015-8859 affecting package nodejs-nodemon 2.0.3-5

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors...

AZL-44784 CVE-2013-6444 affecting package pywbem 0.17.6-12

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

AZL-6692 CVE-2012-5627 affecting package mysql for versions less than 8.0.24-1

Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the changeuser command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks...

AZL-37052 CVE-2005-0198 affecting package uw-imap 2007f-27

A logic error in the CRAM-MD5 code for the University of Washington IMAP UW-IMAP server, when Challenge-Response Authentication Mechanism with MD5 CRAM-MD5 is enabled, does not properly enforce all the required conditions for successful authentication, which allows remote attackers to authenticat...

AZL-7198 CVE-2002-0130 affecting package efax 0.9a-34

Buffer overflow in efax 0.9 and earlier, when installed setuid root, allows local users to execute arbitrary code via a long -x argument...

AZL-7455 CVE-1999-0901 affecting package ypserv 4.1-4

ypserv allows a local user to modify the GECOS and login shells of other users...

AZL-53404 CVE-1999-1090 affecting package telnet 0.17-81

The default configuration of NCSA Telnet package for Macintosh and PC enables FTP, even though it does not include an "ftp=yes" line, which allows remote attackers to read and modify arbitrary files...

AZL-106893 CVE-2026-107886 affecting package cups 2.4.19-1

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, addclass frees pclass-printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer;...

AZL-106629 CVE-2026-94635 affecting package thrift 0.24.0-1

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AZL-105069 CVE-2026-97058 affecting package js-jquery 3.5.0-4

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

AZL-102309 CVE-2026-93175 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpudmcrtcresetstate frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangling...

AZL-105209 CVE-2026-92987 affecting package openvmm 0.1.0-1

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

AZL-100895 CVE-2026-89722 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio pciwritelegacyio loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; return...

AZL-100103 CVE-2026-89547 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

AZL-100917 CVE-2026-83530 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

AZL-100908 CVE-2026-87766 affecting package bubblewrap for versions less than 0.12.0-1

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

AZL-98496 CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

AZL-98072 CVE-2026-80691 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

AZL-98084 CVE-2026-80692 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

AZL-98057 CVE-2026-80684 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

AZL-97845 CVE-2026-80576 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

AZL-97713 CVE-2026-80550 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

AZL-97287 CVE-2026-74658 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

AZL-96770 CVE-2026-65959 affecting package vitess for versions less than 19.0.4-13

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

AZL-96069 CVE-2026-74460 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

AZL-96641 CVE-2026-56859 affecting package golang 1.25.12-1

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

AZL-95744 CVE-2026-14677 affecting package postgresql for versions less than 16.15-1

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixe...

AZL-95723 CVE-2026-14663 affecting package postgresql for versions less than 16.15-1

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

AZL-95943 CVE-2026-13622 affecting package kubevirt 1.8.4-2

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

AZL-95559 CVE-2026-73077 affecting package vim for versions less than 9.2.0957-1

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

AZL-95601 CVE-2026-71217 affecting package iperf3 for versions less than 3.17.1-5

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

AZL-94838 CVE-2026-68401 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

AZL-94476 CVE-2026-64581 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

AZL-94470 CVE-2026-64573 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

AZL-94404 CVE-2026-64562 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...

AZL-94181 CVE-2026-7260 affecting package php for versions less than 8.3.33-1

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

AZL-94071 CVE-2026-64544 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...

AZL-94019 CVE-2026-17574 affecting package hdf5 for versions less than 1.14.6-4

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

AZL-92937 CVE-2026-52863 affecting package unbound for versions less than 1.25.2-1

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

AZL-93072 CVE-2026-16560 affecting package 389-ds-base 3.1.1-12

A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation...

AZL-93222 CVE-2026-56852 affecting package kubernetes for versions less than 1.30.10-27

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-92778 CVE-2026-63960 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pdmessage in wcovereadrxbuffer wcovereadrxbuffer copies the PD RX FIFO into the caller's struct pdmessage with for i = 0; i regmap, USBCRXDATA + i, msg + i; which has two problems:...

AZL-92576 CVE-2026-53399 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into cl-clstateids via idralloccyclic under cllock before returning to nfsd4alloclayoutstateid. When nfsd4layoutsetlease then fails, the error pat...

AZL-92346 CVE-2026-57218 affecting package rabbitmq-server for versions less than 3.13.7-8

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

AZL-92343 CVE-2026-57213 affecting package rabbitmq-server for versions less than 3.13.7-8

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqfederationmanagement plugin renders the consumertag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute...