UBUNTU-CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

UBUNTU-CVE-2026-93858

In OpenStack Mistral through 23.0.0, the std.sshproxied action passes a caller-supplied proxycommand value directly to paramiko.ProxyCommand before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an...

UBUNTU-CVE-2026-108985

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfszdrbytes, libnfszdrstring, and libnfszdrarray. The caller-supplied maxsize value is not honored...

UBUNTU-CVE-2026-98382

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

UBUNTU-CVE-2026-107695

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parseplaylist accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that...

UBUNTU-CVE-2026-107817

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data cou...

UBUNTU-CVE-2026-108981

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

UBUNTU-CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cooki...

UBUNTU-CVE-2026-108104

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared...

UBUNTU-CVE-2026-107655

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Interne...

UBUNTU-CVE-2026-95702

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The...

UBUNTU-CVE-2026-107325

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

UBUNTU-CVE-2026-95209

An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service DoS...

UBUNTU-CVE-2026-107818

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

UBUNTU-CVE-2026-108538

A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gfmxv of the file utils/osthread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be use...

UBUNTU-CVE-2026-104635

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

UBUNTU-CVE-2026-44033

Uncontrolled recursion in XMLNode::ParseXMLElement and XMLNode::emptyTheNode in the bundled XML parser ofstd/libsrc/ofxml.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML document with deeply nested elements. The parser i...

UBUNTU-CVE-2026-78359

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend...

UBUNTU-CVE-2026-105829

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone script or iframe line followed by a block supplying...

UBUNTU-CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

UBUNTU-CVE-2026-44034

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RL...

UBUNTU-CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

UBUNTU-CVE-2026-106432

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt proces...

UBUNTU-CVE-2026-107660

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tlsopen of libavformat/tlsmbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issu...

UBUNTU-CVE-2026-107935

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

UBUNTU-CVE-2026-107611

An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared...

UBUNTU-CVE-2026-107823

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could...

UBUNTU-CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPPTAGZERO, but addjob converts these separators to IPPTAGJOB. During job startup, getoptions/ipplength subsequentl...

UBUNTU-CVE-2026-98385

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple schedcachegroup from mm to fix UAF Currently the sched cache grouping is by mm and the scheduling statistics schedcachestat lives in the mm structure. This ties the life cycle of scheduling stats with mm. In...

UBUNTU-CVE-2026-78357

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

UBUNTU-CVE-2026-92262

Bulletin has no description...

UBUNTU-CVE-2026-97147

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and...

UBUNTU-CVE-2026-108106

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

UBUNTU-CVE-2026-93860

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenanc...

UBUNTU-CVE-2026-106433

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

UBUNTU-CVE-2026-92705

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by Automation Scripts metadata in ASS subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted AS...

UBUNTU-CVE-2026-105830

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

UBUNTU-CVE-2026-89091

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

UBUNTU-CVE-2026-108093

A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and...

UBUNTU-CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

UBUNTU-CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

UBUNTU-CVE-2026-107324

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

UBUNTU-CVE-2026-107634

Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in getdataset and getnextdatum that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted,...

UBUNTU-CVE-2026-106436

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the...

UBUNTU-CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanizerequestheaders= is reapplied by Mechanize::HTTP::Agentrequestaddheaders even after...

UBUNTU-CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

UBUNTU-CVE-2026-44031

Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service stack exhaustion and process crash via a DICOM dataset containing deeply nested sequences SQ elements. The datase...

UBUNTU-CVE-2026-78356

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

UBUNTU-CVE-2026-108752

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

UBUNTU-CVE-2026-93581

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...