AZL-100172 CVE-2026-80928 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...

AZL-100532 CVE-2026-80930 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...

AZL-100751 CVE-2026-80926 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...

AZL-100286 CVE-2026-80931 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

AZL-101727 CVE-2026-89329 affecting package device-mapper-multipath 0.9.6-1

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

AZL-103383 CVE-2026-87910 affecting package python3 3.12.14-2

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

AZL-103386 CVE-2026-78807 affecting package wpa_supplicant 2.10-3

An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

AZL-101736 CVE-2026-18495 affecting package libtiff 4.6.0-14

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...

AZL-101778 CVE-2026-87776 affecting package python-tensorboard 2.16.2-6

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

AZL-101742 CVE-2026-89147 affecting package net-snmp 5.9.5.2-1

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smuxaccept performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the...

AZL-101739 CVE-2026-77159 affecting package libvirt 11.9.0-1

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

AZL-101111 CVE-2026-13326 affecting package qt6-qtconnectivity 6.5.7-1

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag...

AZL-101799 CVE-2026-89160 affecting package rust 1.75.0-31

PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...

AZL-100056 CVE-2026-89160 affecting package pcre2 for versions less than 10.48-1

PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...

AZL-101745 CVE-2026-89160 affecting package nmap 7.95-5

PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...

AZL-101763 CVE-2026-89160 affecting package php 8.3.33-1

PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...

AZL-101766 CVE-2026-89161 affecting package php 8.3.33-1

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

AZL-101790 CVE-2026-89161 affecting package qtbase 6.6.3-5

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

AZL-101823 CVE-2026-89161 affecting package rust 1.96.1-1

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

AZL-100053 CVE-2026-89161 affecting package pcre2 10.42-3

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

AZL-101802 CVE-2026-89161 affecting package rust 1.75.0-31

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...

AZL-101817 CVE-2026-89160 affecting package rust 1.96.1-1

PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...

AZL-101787 CVE-2026-89160 affecting package qtbase 6.6.3-5

PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...

AZL-101796 CVE-2026-89156 affecting package qtbase 6.6.3-5

PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...

AZL-101751 CVE-2026-89158 affecting package nmap 7.95-5

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

AZL-101757 CVE-2026-89158 affecting package php 8.3.33-1

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

AZL-101811 CVE-2026-89157 affecting package rust 1.75.0-31

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

AZL-101793 CVE-2026-89158 affecting package qtbase 6.6.3-5

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

AZL-100062 CVE-2026-89158 affecting package pcre2 for versions less than 10.48-1

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

AZL-101805 CVE-2026-89158 affecting package rust 1.75.0-31

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

AZL-101117 CVE-2026-89158 affecting package ripgrep 13.0.0-14

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

AZL-101114 CVE-2026-89157 affecting package ripgrep 13.0.0-14

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

AZL-101814 CVE-2026-89158 affecting package rust for versions less than 1.96.0-1

PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...

AZL-100065 CVE-2026-89156 affecting package pcre2 for versions less than 10.48-1

PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...

AZL-100059 CVE-2026-89157 affecting package pcre2 for versions less than 10.48-1

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

AZL-101826 CVE-2026-89157 affecting package rust for versions less than 1.96.0-1

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

AZL-101748 CVE-2026-89157 affecting package nmap 7.95-5

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

AZL-101754 CVE-2026-89156 affecting package nmap 7.95-5

PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...

AZL-101808 CVE-2026-89156 affecting package rust 1.75.0-31

PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...

AZL-101820 CVE-2026-89156 affecting package rust 1.96.1-1

PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...

AZL-101760 CVE-2026-89157 affecting package php 8.3.33-1

PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...

AZL-100049 CVE-2026-78135 affecting package strongswan for versions less than 5.9.14-11

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATECHILDSA requests are mishandled, there can be an authentication bypass...

AZL-100019 CVE-2026-89092 affecting package glibc 2.38-21

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

AZL-101829 CVE-2026-78133 affecting package strongswan 5.9.14-11

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling...

AZL-100025 CVE-2026-78129 affecting package strongswan for versions less than 5.9.14-11

strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS5 decryption...

AZL-100034 CVE-2026-78134 affecting package strongswan for versions less than 5.9.14-11

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity...

AZL-100031 CVE-2026-78131 affecting package strongswan for versions less than 5.9.14-11

strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser...

AZL-100028 CVE-2026-78130 affecting package strongswan for versions less than 5.9.14-11

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser...

AZL-100046 CVE-2026-78132 affecting package strongswan for versions less than 5.9.14-11

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax...

AZL-100040 CVE-2026-78127 affecting package strongswan for versions less than 5.9.14-11

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser...