8,435 results · Feed
-
High max 8.8USN-8848-1 3 CVEs
python-django vulnerabilities
Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue…
first Sep 30, 2026 -
High max 7.5USN-8861-1 2 CVEs
openssl vulnerabilities
It was discovered that OpenSSL had an inefficient algorithm in its QUIC stream reassembly implementation. A remote attacker could possibly use this issue to cause OpenSSL to use excessive CPU resources, leading to a denial of service. (CVE-2026-42772) It was …
first Oct 1, 2026 -
High max 8.2USN-8847-2 4 CVEs
openssl, openssl1.0 vulnerabilities
USN-8847-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenSSL incorrectly handled cer…
first Sep 29, 2026 -
High max 8.2USN-8847-1 11 CVEs
openssl vulnerabilities
It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. (CVE-2026-35189) It was …
first Sep 29, 2026 -
Medium max 6.6USN-8863-1 4 CVEs
gst-plugins-good1.0 vulnerabilities
Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio streams. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-17072) Seonwook Kim discovered that GStreamer Good Plugins incorrectly p…
first Oct 1, 2026 -
Medium max 5.5USN-8862-1 1 CVE
libxpm vulnerability
It was discovered that libXpm did not correctly handle XPM images with zero-dimension values. A local attacker could possibly use this issue to cause libXpm to use excessive resources, leading to a denial of service.
first Oct 1, 2026 -
Medium max 6.5USN-8857-1 1 CVE
kf6-kcoreaddons vulnerability
It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary …
first Oct 1, 2026 -
Critical max 9.6USN-8860-1 1 CVE
designate vulnerability
It was discovered that OpenStack Designate did not properly validate overlapping zones under certain circumstances. An authenticated user could possibly use this issue to redirect DNS traffic to attacker-controlled systems or cause a denial of service.
-
High max 7.6USN-8855-1 1 CVE
gst-plugins-bad1.0 vulnerability
It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio blocks. An attacker could possibly use this issue with a specially crafted WAV file to cause the program to crash, resulting in a denial of service, or possibly…
first Sep 30, 2026 -
High max 8.8USN-8845-1 2 CVEs
gvfs vulnerabilities
Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. (CVE-2026-84268) It was dis…
first Sep 30, 2026 -
Medium max 6.5USN-8856-1 1 CVE
kdenlive, mlt vulnerability
It was discovered that Kdenlive allowed dangerous proxy parameters when processing attacker-controlled project files. An attacker could use this to execute arbitrary commands via the MLT framework's ante/post consumer properties.
first Sep 30, 2026 -
Critical max 9.8USN-8858-1 1 CVE
libauthen-sasl-perl vulnerability
It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access.
first Sep 30, 2026 -
High max 7.6USN-8854-1 3 CVEs
keystone vulnerabilities
Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. …
first Sep 30, 2026 -
High max 7.5USN-8853-1 1 CVE
opensbi vulnerability
It was discovered that OpenSBI did not properly validate the counter index mask in SBI PMU extension requests. An attacker could use this issue to cause a denial of service.
first Sep 30, 2026 -
Critical max 9.3USN-8561-1 34 CVEs
freerdp3 vulnerabilities
It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.
first Jul 20, 2026 -
Critical max 9.6USN-8416-1 1 CVE
golang-golang-x-net-dev vulnerability
It was discovered that Go Networking incorrectly handled certain Punycode-encoded labels in the idna package. An attacker could possibly use this issue to bypass hostname-based access restrictions.
first Jun 9, 2026 -
Critical max 9.4USN-8730-7 1 CVE
linux-fips vulnerability
A security issue was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystems: - IPv6 networking; - Netfilter;
-
Critical max 9.8USN-8851-1 3 CVEs
linux, linux-aws, linux-azure, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-xilinx-zynqmp vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system (NFS) server daemon; - IPv6 networking; - Netfilter; (CVE…
-
Critical max 9.8USN-8850-1 8 CVEs
linux-bluefield vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system (NFS) server daemon; - OCFS2 file system; - IPv6 networki…
-
Critical max 9.8USN-8819-4 3 CVEs
linux-aws-fips, linux-azure-fips, linux-fips vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system (NFS) server daemon; - IPv6 networking; - Netfilter; (CVE…
-
Critical max 9.8LSN-0119-1 8 CVEs
Kernel Live Patch Security Notice
In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry'…
first Apr 13, 2026 -
Critical max 9.8USN-8841-1 2 CVEs
libdbi-perl vulnerabilities
It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-73193, CVE-2026-73194)
first Sep 29, 2026 -
Critical max 9.8USN-8843-1 6 CVEs
freeipmi vulnerabilities
It was discovered that FreeIPMI incorrectly handled certain malformed Fujitsu SEL long-text responses, leading to a stack-based buffer overflow. An attacker in control of a malicious IPMI device could possibly use this issue to cause FreeIPMI to crash, result…
first Sep 29, 2026 -
High max 7.5USN-8844-1 1 CVE
c-ares vulnerability
It was discovered that c-ares incorrectly handled certain query completion callbacks. An attacker could possibly use this issue to trigger a use- after-free or double-free, resulting in a denial of service or arbitrary code execution.
-
High max 8.4USN-8840-1 2 CVEs
libevent vulnerabilities
Michał Majchrowicz and Marcin Wyczechowski discovered that libevent incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63387) It was discovered that libe…
first Sep 28, 2026 -
Critical max 9.8USN-8819-3 3 CVEs
linux-aws-hwe, linux-azure, linux-azure-4.15 vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system (NFS) server daemon; - IPv6 networking; - Netfilter; (CVE…
-
UnscoredUSN-8487-2 0 CVEs
curl regression
USN-8487-1 fixed vulnerabilities in curl. Unfortunately that update contained an incomplete fix for CVE-2026-8927. This update fixes the problem. Original advisory details: Andrew Nesbitt discovered that curl could reuse an existing live connection during STA…
first Sep 28, 2026 -
High max 7.3USN-8829-1 1 CVE
plasma-workspace vulnerability
Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user.
-
Critical max 9.1USN-8827-1 19 CVEs
erlang vulnerabilities
It was discovered that the Erlang Port Mapper Daemon did not properly handle slow connections. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-42792) It was discovered that Erlang incorrectly handled certain external te…
-
High max 8.6USN-8837-1 2 CVEs
pdfminer vulnerabilities
It was discovered that pdfminer did not safely parse specially crafted PDF files. An attacker could possibly use these issues to execute arbitrary code. (CVE-2025-64512, CVE-2025-70559)
-
Medium max 5.9USN-8832-1 1 CVE
booth vulnerability
It was discovered that Booth did not properly validate message authentication codes under certain circumstances. A remote attacker could possibly use this issue to bypass authentication.
-
High max 7.5USN-8828-1 4 CVEs
dracut vulnerabilities
It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-8637) I…
-
High max 8.4USN-8838-1 3 CVEs
catdoc vulnerabilities
It was discovered that catdoc had an integer overflow when processing shared string tables in malformed spreadsheet files. An attacker could possibly use this issue to cause catdoc to crash or execute arbitrary code. (CVE-2024-48877) It was discovered that ca…
-
High max 8.4USN-8839-1 3 CVEs
atril vulnerabilities
It was discovered that Atril did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-46529) It was discovered that At…
-
Medium max 6.1USN-8835-1 1 CVE
emacs vulnerability
It was discovered that Emacs improperly handled specially crafted SVG images, resulting in memory corruption. An attacker could possibly use this issue to cause Emacs to crash, resulting in a denial of service, or obtain sensitive information.
-
High max 8.2USN-8830-1 3 CVEs
php-phpseclib vulnerabilities
It was discovered that phpseclib did not perform constant-time padding validation when using AES in CBC mode. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-32935) It was discovered that phpseclib did not use a cons…
-
UnscoredUSN-8836-1 0 CVEs
freerdp3 vulnerabilities
It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.
-
High max 7.8USN-8833-1 5 CVEs
libvirt-hwe vulnerabilities
It was discovered that libvirt did not properly validate newline characters in DNS TXT record values and SRV record attributes in its virtual network driver. A local attacker with permission to define virtual networks could possibly use this issue to inject a…
-
High max 7.5USN-8834-1 4 CVEs
exim4 vulnerabilities
It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker-controlled proxy. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-94054) It was discovered that Exim had a use-after-free…
-
High max 7.8USN-8831-1 2 CVEs
libvirt vulnerabilities
It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-18917) It was discovered that libvirt di…