2,451 results · Clear filters · Feed
-
High max 8.8
linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-kvm, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx, linux-oracle, linux-raspi, linux-realtime vulnerabilities
It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processin…
first Jun 4, 2026 -
High max 8.6USN-8657-1 7 CVEs
vim vulnerabilities
It was discovered that Vim incorrectly handled memory when decoding certain JSON input. An attacker could possibly use this issue to cause Vim to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu …
first Aug 20, 2026 -
High max 7.8
linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop vulnerabilities
Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or pos…
first Mar 5, 2025 -
High max 7.6USN-8890-1 8 CVEs
libsoup2.4, libsoup3 vulnerabilities
It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that li…
first Oct 6, 2026 -
High max 8.9USN-8642-1 4 CVEs
c3p0 vulnerabilities
It was discovered that c3p0 was vulnerable to remote code execution via maliciously crafted serialized objects and JNDI references. An attacker could use this to execute arbitrary code, bypass security restrictions, or cause a denial of service.
first Aug 18, 2026 -
High max 8.6USN-8882-1 10 CVEs
tesseract vulnerabilities
It was discovered that Tesseract incorrectly handled crafted .traineddata models. An attacker could possibly use this issue to cause Tesseract to crash, resulting in a denial of service. (CVE-2026-73067) It was discovered that Tesseract did not properly valid…
-
High max 7.6USN-8874-1 1 CVE
sg3-utils vulnerability
Shaomin Chen discovered that sg3_utils did not properly sanitize device identification data. An attacker could possibly use this issue to execute arbitrary commands.
-
High max 8.4USN-8870-1 1 CVE
aodh, watcher vulnerability
Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher webhook trigger endpoint did not apply authorization. An attacker could possibly use this issue to access sensitive alar…
first Oct 5, 2026 -
High max 8.7USN-8869-1 1 CVE
rabbitmq-server vulnerability
It was discovered that RabbitMQ Server incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to cause a denial of service via memory exhaustion.
-
High max 7.3USN-8868-1 8 CVEs
libreoffice vulnerabilities
It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-63272) It was discovered that LibreOffice…
-
High max 8.1USN-8867-1 1 CVE
ceph vulnerability
It was discovered that the Ceph Object Gateway (RGW) SigV4 handler did not reject requests carrying x-amz-* headers that were absent from the signed header set. An attacker holding a presigned URL could possibly use this issue to attach arbitrary unsigned x-a…
-
High max 7.8USN-8361-2 1 CVE
linux-fips vulnerability
A security issue was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystem: - Packet sockets; (CVE-2026-31504)
first Jun 4, 2026 -
High max 8.8USN-8848-1 3 CVEs
python-django vulnerabilities
Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue…
first Sep 30, 2026 -
High max 7.5USN-8861-1 2 CVEs
openssl vulnerabilities
It was discovered that OpenSSL had an inefficient algorithm in its QUIC stream reassembly implementation. A remote attacker could possibly use this issue to cause OpenSSL to use excessive CPU resources, leading to a denial of service. (CVE-2026-42772) It was …
first Oct 1, 2026 -
High max 8.2USN-8847-2 4 CVEs
openssl, openssl1.0 vulnerabilities
USN-8847-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenSSL incorrectly handled cer…
first Sep 29, 2026 -
High max 8.2USN-8847-1 11 CVEs
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. (CVE-2026-35189) It was …
first Sep 29, 2026 -
High max 7.6USN-8855-1 1 CVE
gst-plugins-bad1.0 vulnerability
It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio blocks. An attacker could possibly use this issue with a specially crafted WAV file to cause the program to crash, resulting in a denial of service, or possibly…
first Sep 30, 2026 -
High max 8.8USN-8845-1 2 CVEs
gvfs vulnerabilities
Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. (CVE-2026-84268) It was dis…
first Sep 30, 2026 -
High max 7.6USN-8854-1 3 CVEs
keystone vulnerabilities
Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. …
first Sep 30, 2026 -
High max 7.5USN-8853-1 1 CVE
opensbi vulnerability
It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service.
first Sep 30, 2026 -
High max 7.5USN-8844-1 1 CVE
c-ares vulnerability
It was discovered that c-ares incorrectly handled certain query completion callbacks. An attacker could possibly use this issue to trigger a use- after-free or double-free, resulting in a denial of service or arbitrary code execution.
-
High max 8.4USN-8840-1 2 CVEs
libevent vulnerabilities
Michał Majchrowicz and Marcin Wyczechowski discovered that libevent incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63387) It was discovered that libe…
first Sep 28, 2026 -
High max 7.3USN-8829-1 1 CVE
plasma-workspace vulnerability
Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user.
-
High max 8.6USN-8837-1 2 CVEs
pdfminer vulnerabilities
It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use these issues to execute arbitrary code. (CVE-2025-64512, CVE-2025-70559)
-
High max 7.5USN-8828-1 4 CVEs
dracut vulnerabilities
It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-8637) I…
-
High max 8.4USN-8838-1 3 CVEs
catdoc vulnerabilities
It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could possibly use this issue to cause catdoc to crash or execute arbitrary code. (CVE-2024-48877) It was discovered that ca…
-
High max 8.4USN-8839-1 3 CVEs
atril vulnerabilities
It was discovered that Atril did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-46529) It was discovered that At…
-
High max 8.2USN-8830-1 3 CVEs
php-phpseclib vulnerabilities
It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC mode. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-32935) It was discovered that phpseclib did not use a cons…
-
High max 7.8USN-8833-1 5 CVEs
libvirt-hwe vulnerabilities
It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject a…
-
High max 7.5USN-8834-1 4 CVEs
exim4 vulnerabilities
It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-94054) It was discovered that Exim had a use-after-free…
-
High max 7.8USN-8831-1 2 CVEs
libvirt vulnerabilities
It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-18917) It was discovered that libvirt di…
-
High max 7.4USN-8823-1 5 CVEs
pyjwt vulnerabilities
It was discovered that PyJWT incorrectly handled certain URIs when using PyJWKClient. A remote attacker could possibly use this issue to perform server-side request forgery (SSRF) or expose sensitive local files. This issue only affected Ubuntu 22.04 LTS, Ubu…
first Sep 25, 2026 -
High max 7.3USN-8822-1 2 CVEs
libwebsockets vulnerabilities
It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. (CVE-2…
first Sep 25, 2026 -
High max 8.7USN-8824-1 1 CVE
libpcap vulnerability
It was discovered that libpcap did not properly validate BPF instructions in some situation. An attacker could possibly use this issue to perform out of bound memory operations.
-
High max 7.1USN-8821-1 1 CVE
swift vulnerability
It was discovered that OpenStack Swift incorrectly handled truncated aws-chunked PUT request bodies in its s3api middleware. An authenticated attacker could possibly use this issue to cause OpenStack Swift to use excessive resources, leading to a denial of se…
first Sep 24, 2026 -
High max 7.5USN-8813-1 11 CVEs
expat vulnerabilities
It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411) It was discovered that E…
first Sep 24, 2026 -
High max 7.4USN-8812-1 7 CVEs
gdal vulnerabilities
It was discovered that GDAL incorrectly handled certain netCDF files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-49014) It was discovered th…
first Sep 24, 2026 -
High max 8.2USN-8811-1 1 CVE
python-urllib3 vulnerability
It was discovered that urllib3 did not correctly strip sensitive HTTP headers during cross-origin redirects. An attacker could possibly use this issue to leak sensitive information.
-
High max 8.7USN-8807-1 1 CVE
Open-iSNS vulnerability
It was discovered that Open-iSNS contained a double-free vulnerability when decoding malformed iSNS attributes. An unauthenticated attacker could possibly use this to cause a denial of service.
first Sep 23, 2026 -
High max 8.8USN-8809-1 1 CVE
libgit2 vulnerability
Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly handled certain repository URLs when using the SSH transport. A remote attacker could possibly use this issue to execute arbitrary commands.
first Sep 23, 2026