60861 matches found
DEBIAN-CVE-2026-52065
Bulletin has no description...
DEBIAN-CVE-2026-52070
Bulletin has no description...
DEBIAN-CVE-2026-52055
Bulletin has no description...
DEBIAN-CVE-2026-52058
Bulletin has no description...
DEBIAN-CVE-2026-52079
Bulletin has no description...
DEBIAN-CVE-2026-52066
Bulletin has no description...
DEBIAN-CVE-2026-52057
Bulletin has no description...
DEBIAN-CVE-2026-52054
Bulletin has no description...
DEBIAN-CVE-2026-18663
A flaw was found in 389-ds-base. The getldapmessagecontrolsext function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPIREQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An...
DEBIAN-CVE-2026-19566
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...
DEBIAN-CVE-2026-9318
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...
DEBIAN-CVE-2026-19588
Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers...
DEBIAN-CVE-2026-19587
Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation...
DEBIAN-CVE-2026-68450
In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert addrelocroot allocates a mappingnode before inserting it into rc-relocroottree. If rbsimpleinsert finds an existing entry, it returns the existing rbnode and leaves the newl...
DEBIAN-CVE-2026-68449
In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: fix infinite loop in NCQ tag completion bit-scanning The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When tagmask has only high bits set e.g. 0x80000000, the inner while...
DEBIAN-CVE-2026-68447
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cphqdcntlstacksize from hardware without bounding it to the allocated BO region. If the HW field is larger than...
DEBIAN-CVE-2026-68448
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copyfilerange to copy across devices" allowed filesystems that implement the copyfilerange fop to decide if they want to access...
DEBIAN-CVE-2026-68444
In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix NULL dereference in ffapartitioninfoget ffapartitioninfoget passes uuidstr directly to uuidparse without a NULL check. When a caller passes NULL, uuidparse - uuidparse - uuidisvalid dereferences the pointer,...
DEBIAN-CVE-2026-68443
In the Linux kernel, the following vulnerability has been resolved: hwmon: gigabytewaterforce Stop device IO before calling hidhwstop Calling hidhwstop does not stop the device IO. This results in a race condition between hidinputreport and the point immediately following the execution of...
DEBIAN-CVE-2026-68438
In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d "smp: Improve smpcallfunctionsingle CSD-lock diagnostics" changed smpcallfunctionsingle so that, when CSD lock debugging is enabled, async !wait calls use t...
DEBIAN-CVE-2026-68445
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4gemobjectmmap rejects a writable mapping of a validated shader BO, but leaves VMMAYWRITE set. Userspace can map the BO read-only and then turn it writable with mprotec...
DEBIAN-CVE-2026-68439
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...
DEBIAN-CVE-2026-68441
In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT ex: via an eBPF program calling bpfredirect or an actbpf action, the redirect was silently lost i.e ...
DEBIAN-CVE-2026-68442
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENTFLAGLOGGING to split extent maps When btrfsdropextentmaprange splits an extent map, the new split maps inherit the original map's flags through a local 'flags' variable. Commit f86f7a75e2fb "btrfs: us...
DEBIAN-CVE-2026-68446
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...
DEBIAN-CVE-2026-68440
In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbereadeepromhostif always copies rounduplength, 4 bytes into the caller buffer, which ethtool allocates with exactly 'length' bytes. A non-4-aligned length therefore...
DEBIAN-CVE-2026-68430
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUGON There's no need to crash the kernel for this case. cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891...
DEBIAN-CVE-2026-68435
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...
DEBIAN-CVE-2026-68432
In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns vxlan-net. They differ once the device is created in or moved to a netns oth...
DEBIAN-CVE-2026-68434
In the Linux kernel, the following vulnerability has been resolved: serial: 8250mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Commit b1b4efea05a5 "serial: 8250mid: Disable DMA for selected platforms" replaced the dnvboard setup and exit callbacks with PTRIFfalse, ..., whic...
DEBIAN-CVE-2026-68433
In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...
DEBIAN-CVE-2026-68437
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's preparejob callback: - checks for internal driver dependencies for the geometry job; -...
DEBIAN-CVE-2026-68431
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2PROTONUMBER. A packet carrying SMB2TRANSFORMPROTONUM bypasses the check even when the...
DEBIAN-CVE-2026-68436
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time most of it the two inlined dcscratchspace copies and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual siz...
DEBIAN-CVE-2026-68429
In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link-loss event can tear down the MST topology setting mgr-mststate = false and mgr-mstprimary = NULL concurrently with a caller invoking...
DEBIAN-CVE-2026-73249
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...
DEBIAN-CVE-2026-73248
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...
DEBIAN-CVE-2026-5917
libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...
DEBIAN-CVE-2026-29036
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...
DEBIAN-CVE-2026-19556
Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-19560
Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-19557
Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-19559
Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-19558
Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: High...
DEBIAN-CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...
DEBIAN-CVE-2026-29035
CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...
DEBIAN-CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
DEBIAN-CVE-2026-73283
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
DEBIAN-CVE-2026-73281
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension...