DEBIAN-CVE-2026-80992

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

DEBIAN-CVE-2026-80953

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...

DEBIAN-CVE-2026-45769

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessi...

DEBIAN-CVE-2026-46387

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

DEBIAN-CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

DEBIAN-CVE-2026-85485

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

DEBIAN-CVE-2026-85769

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or state/migration restore, a malformed state blob can supply an oversized skip-block length that is not validated against the remaining si...

DEBIAN-CVE-2026-57166

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling paths write an attacker-influenced amoun...

DEBIAN-CVE-2026-57162

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer sdesencodesdp in transportsrtpsdes.c. This affects applications with...

DEBIAN-CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

DEBIAN-CVE-2026-84947

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

DEBIAN-CVE-2026-76177

Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...

DEBIAN-CVE-2026-65140

Bulletin has no description...

DEBIAN-CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

DEBIAN-CVE-2026-84640

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

DEBIAN-CVE-2026-82820

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amfstringnew of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made publi...

DEBIAN-CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

DEBIAN-CVE-2026-63109

Bulletin has no description...

DEBIAN-CVE-2026-17516

Bulletin has no description...

DEBIAN-CVE-2026-82328

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

DEBIAN-CVE-2026-82247

gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...

DEBIAN-CVE-2026-33604

An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that...

DEBIAN-CVE-2026-80696

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missing return statement to fix the problem...

DEBIAN-CVE-2026-80702

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned long allocation-size field; the intended target is the adjacent...

DEBIAN-CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

DEBIAN-CVE-2026-80645

In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721dbdpc With a listforeach loop, if we don't find the item we are looking for in the list, then the loop exits with the iterator, which is "dbell" in this loop, pointing to invalid...

DEBIAN-CVE-2026-80641

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 "wifi: wlcore: Add support for IGTK key" lets the amount of ciphers decrease on every boot of a too old...

DEBIAN-CVE-2026-80637

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and putunalignedbe32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory acces...

DEBIAN-CVE-2026-80640

In the Linux kernel, the following vulnerability has been resolved: cxl/fwctl: Fix fortifypanic Fix a runtime assertion in cxlctlgetsupportedfeatures. Fortify complains that it is potentially overflowing the entries array per countedbylenumentries. Quiet the false positive by initializing...

DEBIAN-CVE-2026-80601

In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

DEBIAN-CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

DEBIAN-CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

DEBIAN-CVE-2026-79780

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

DEBIAN-CVE-2026-68516

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

DEBIAN-CVE-2026-74721

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdnainsertpages Two error paths in amdxdnainsertpages called vma-vmops-closevma before returning an error code to the caller. This is incorrect: amdxdnagemobjmmap registers an HMM...

DEBIAN-CVE-2026-77642

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019...

DEBIAN-CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

DEBIAN-CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

DEBIAN-CVE-2026-74435

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpcverifydata ensure rxdecbuffer alloc rxrpcrecvmsgdata calls rxrpcverifydata whenever the rxrpccall.rxdecbuffer is unallocated and assumes that upon successful return that rxdecbuffer must be allocated. However,...

DEBIAN-CVE-2026-74410

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer In rtwpcirxnapi, newlen is computed as the sum of pktlen 14-bit descriptor field, max 16383 and pktoffset drvinfosz + shift, both firmware-controlled. The...

DEBIAN-CVE-2026-74370

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the...

DEBIAN-CVE-2026-72082

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...

DEBIAN-CVE-2026-72008

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

DEBIAN-CVE-2026-15554

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

DEBIAN-CVE-2026-71968

OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted Application to corrupt secure-world kernel memory by setting the TAFLAGCONCURRENT flag in a user TA signed...

DEBIAN-CVE-2026-15060

When systemd-machined = v259 or v258 with a custom polkit policy that allows register-machine access is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless...

DEBIAN-CVE-2026-68384

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...

DEBIAN-CVE-2026-68087

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

DEBIAN-CVE-2026-12261

A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...

DEBIAN-CVE-2026-71436

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...