8,435 results · Feed
-
Medium max 5.4USN-8495-1 1 CVE
nghttp2 vulnerability
It was discovered that the nghttp2 nghttpx proxy incorrectly handled HTTP/1.1 Upgrade requests that included a Content-Length header and body. A remote attacker could possibly use this issue to perform HTTP request and response smuggling attacks against backe…
-
Critical max 9.1USN-8467-2 2 CVEs
perl vulnerabilities
USN-8467-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 25.10. Original advisory details: It was discovered that Perl's Archive::Tar module incorrectly handled symlink and hardlink targets during extraction. An …
-
UnscoredUSN-8486-1 0 CVEs
libssh2 vulnerabilities
It was discovered that libssh2 incorrectly handled the sftp_symlink() function. A malicious SSH server or machine-in-the-middle attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2025-15661) It was discov…
first Jun 30, 2026 -
Critical max 9.3USN-8483-1 2 CVEs
hplip vulnerabilities
It was discovered that HPLIP incorrectly handled certain print data. An attacker could possibly use this issue to cause HPLIP to execute arbitrary code. (CVE-2026-8631) It was discovered that HPLIP incorrectly handled certain inputs. A local attacker could po…
-
Critical max 9.8USN-8484-1 1 CVE
libgd-perl vulnerability
It was discovered that GD.pm incorrectly handled filename arguments. An attacker could possibly use this issue to execute arbitrary commands or overwrite files.
-
Medium max 6.5USN-8485-1 1 CVE
libyang vulnerability
It was discovered that libyang incorrectly handled certain metadata list pointers. An attacker could use this issue to cause libyang to crash, resulting in a denial of service, or possibly execute arbitrary code.
-
UnscoredUSN-8478-1 0 CVEs
ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities
It was discovered that Ruby's Net::IMAP library did not properly verify that TLS encryption was started after issuing a STARTTLS command. A remote attacker could use this to perform a machine-in-the-middle attack and silently bypass TLS encryption. (CVE-2026-…
first Jun 29, 2025 -
UnscoredUSN-8468-1 0 CVEs
imagemagick vulnerabilities
It was discovered that ImageMagick incorrectly handled certain images when using the wavelet-denoise operator. An attacker could possibly use this issue to trigger a heap buffer over-read, resulting in information disclosure. This issue only affected Ubuntu 1…
first Jun 24, 2026 -
UnscoredUSN-8466-1 0 CVEs
libdbi-perl vulnerabilities
It was discovered that the Perl DBI module incorrectly handled certain error messages. An attacker could use this issue to cause applications using the Perl DBI module to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-9…
first Jun 24, 2026 -
UnscoredUSN-8451-1 0 CVEs
vim vulnerabilities
Srinivas Piskala Ganesh Babu discovered that Vim incorrectly handled directory names when serializing browsed paths to the netrw history file. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-47162) It was discovered that Vim inc…
first Jun 18, 2026 -
UnscoredUSN-8458-1 0 CVEs
nginx vulnerabilities
It was discovered that nginx incorrectly handled large headers when proxying HTTP/2 traffic. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for…
first Jun 22, 2026 -
UnscoredUSN-8454-1 0 CVEs
libheif vulnerabilities
Elhanan Haenel discovered that libheif incorrectly handled certain malformed HEIF sequence files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-32738) Elhanan Haen…
first Jun 18, 2026 -
UnscoredUSN-8447-3 0 CVEs
google-guest-agent vulnerabilities
USN-8447-1 fixed vulnerabilities in Go Cryptography. This update provides the corresponding updates for Go Cryptography code embedded in Google Guest Agent. Original advisory details: It was discovered that Go Cryptography did not properly handle SSH global r…
first Jun 22, 2026 -
UnscoredUSN-8432-1 0 CVEs
freerdp2, freerdp3 vulnerabilities
It was discovered that FreeRDP incorrectly handled memory under certain circumstances, which could lead to an out-of-bounds heap write. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-45700) In addit…
first Jun 16, 2026 -
UnscoredUSN-8447-2 0 CVEs
lxd vulnerabilities
USN-8447-1 fixed vulnerabilities in Go Cryptography. This update provides the corresponding updates for Go Cryptography code embedded in LXD for CVE-2026-39830, CVE-2026-39833, CVE-2026-39834, and CVE-2026-42508. Original advisory details: It was discovered t…
first Jun 18, 2026 -
UnscoredUSN-8447-1 0 CVEs
golang-go.crypto vulnerabilities
It was discovered that Go Cryptography did not properly handle SSH global request responses. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-39830) It was discovered that Go Cryptography did not properly verify user pre…
first Jun 17, 2026 -
UnscoredUSN-8433-1 0 CVEs
keystone vulnerabilities
It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An authenticated attacker with only a reader role could possibly use this issue to bypass the role restrictions imposed on the application credenti…
first Jun 16, 2026 -
UnscoredUSN-8431-1 0 CVEs
ruby2.3, ruby2.5 vulnerabilities
It was discovered that Ruby's Net::IMAP library did not properly verify that Transport Layer Security (TLS) encryption was started after issuing a STARTTLS command. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and …
first Jun 15, 2026 -
UnscoredUSN-8430-1 0 CVEs
adsys vulnerabilities
It was discovered that ADSys did not properly handle certain HTTP/2 frames. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-27141) It was discovered that ADSys did not properly…
first Jun 15, 2026 -
UnscoredUSN-8420-1 0 CVEs
dotnet8, dotnet9, dotnet10 vulnerabilities
It was discovered that .NET did not properly handle link resolution before file access. A local attacker could use this issue to perform unauthorized file tampering and write arbitrary files outside of the intended extraction directory. (CVE-2026-45491) It wa…
first Jun 11, 2026 -
UnscoredUSN-8422-1 0 CVEs
mistral vulnerability
Eduardo Gonzalez Gutierrez and Arnaud Morin discovered that Mistral did not properly enforce access policies on some API endpoints. An attacker could possibly execute arbitrary code on a Mistral worker and possibly extract sensitive data including service cre…
first Jun 11, 2026 -
UnscoredUSN-8419-1 0 CVEs
libhttp-daemon-perl vulnerability
It was discovered that HTTP-Daemon incorrectly handled untrusted input under certain circumstances. A remote attacker could possibly use this issue to execute arbitrary commands, create or overwrite arbitrary files, or expose sensitive information.
first Jun 10, 2026 -
UnscoredUSN-8414-2 0 CVEs
openssl, openssl1.0 vulnerabilities
USN-8414-1 fixed several vulnerabilities in OpenSSL. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: Frank Buss discovered that OpenSSL had a heap buffer …
first Jun 9, 2026 -
UnscoredUSN-8414-1 0 CVEs
openssl vulnerabilities
Frank Buss discovered that OpenSSL had a heap buffer over-read in ASN.1 content parsing. An attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or obtain sensitive information. (CVE-2026-34180) Pavol Zacik and A…
first Jun 9, 2026 -
UnscoredUSN-8401-1 0 CVEs
netty vulnerabilities
It was discovered that Netty's HTTP proxy handler did not properly validate headers when constructing CONNECT requests. An attacker could possibly use this issue to inject arbitrary HTTP headers into CONNECT requests. This issue only affected Ubuntu 18.04 LTS…
first Jun 8, 2026 -
UnscoredUSN-8403-1 0 CVEs
isc-kea vulnerability
Ali Norouzi discovered that Kea DHCP did not properly handle maliciously crafted messages over configured API sockets and HA listeners. A remote attacker could possibly use this issue to cause Kea DHCP to crash, resulting in a denial of service.
first Jun 8, 2026 -
UnscoredUSN-8398-3 0 CVEs
nginx vulnerability
USN-8398-1 fixed a vulnerability in nginx. The update caused a regression and was temporarily reverted in USN-8398-2. This update introduces a complete fix for CVE-2026-49975. We apologize for the inconvenience. Original advisory details: It was discovered th…
first Jun 15, 2026 -
UnscoredUSN-8396-1 0 CVEs
apache2 vulnerabilities
It was discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain privileges. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-24072) Andrew Lacambra, Elhanan Haenel, Tianshuo Han, and Trista…
first Jun 8, 2026 -
UnscoredUSN-8390-1 0 CVEs
linux, linux-azure, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-4.15, linux-gcp-fips, linux-kvm, linux-oracle vulnerability
It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processin…
first Jun 4, 2026 -
UnscoredUSN-8384-1 0 CVEs
apache2 vulnerability
It was discovered that Apache HTTP Server incorrectly handled certain cookie headers in the HTTP/2 implementation. A remote attacker could possibly use this issue to cause Apache HTTP Server to consume excessive resources, resulting in a denial of service.
first Jun 4, 2026 -
UnscoredUSN-8379-1 0 CVEs
python-urllib3 vulnerabilities
It was discovered that urllib3 incorrectly handled cross-origin redirects in ProxyManager. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-44431) It was discovered that urllib3 incorrectly handled decompression of sp…
first Jun 3, 2026 -
UnscoredUSN-8375-1 0 CVEs
nginx vulnerabilities
It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain memory operations when doing SMTP authentication. This could possibly result in sensitive information being sent to the authentication server. (CVE-2025-53859) It was dis…
first Jun 3, 2026 -
UnscoredUSN-8376-1 0 CVEs
frr vulnerabilities
It was discovered that FRR incorrectly handled certain OSPF Traffic Engineering and Segment Routing TLVs. An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-28532) It was discovered that FRR incorrectl…
first Jun 3, 2026 -
UnscoredUSN-8365-1 0 CVEs
dovecot vulnerabilities
It was discovered that Dovecot incorrectly treated some variable expansion pipelines as safe in authentication filters. An attacker could possibly use this issue to perform SQL or LDAP injection attacks. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 …
first Jun 2, 2026 -
UnscoredUSN-8354-1 0 CVEs
nginx vulnerabilities
It was discovered that nginx did not properly validate source addresses in the HTTP/3 QUIC module. A remote attacker could possibly use this issue to bypass authorization checks or rate limiting. This issue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-20…
first Jun 1, 2026 -
UnscoredUSN-8349-1 0 CVEs
rsync vulnerabilities
Calum Hutton discovered that rsync contained a heap-based out-of-bounds read when handling file transfers. A remote attacker with read access to an rsync server could possibly use this issue to cause a denial of service. (CVE-2025-10158) Batuhan Sancak, Damie…
first Jun 1, 2026 -
UnscoredUSN-8343-1 0 CVEs
multipart vulnerability
It was discovered that multipart had an ambiguous regular expression alternation when handling certain HTTP header values. A remote attacker could possibly use this issue to cause multipart to use excessive resources, leading to a denial of service.
first May 28, 2026 -
UnscoredUSN-8341-1 0 CVEs
openjdk-26 vulnerabilities
Thomas Beckers discovered that the JAXP component of OpenJDK 26 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discover…
first May 28, 2026 -
UnscoredUSN-8339-1 0 CVEs
openjdk-25 vulnerabilities
Thomas Beckers discovered that the JAXP component of OpenJDK 25 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discover…
first May 28, 2026 -
UnscoredUSN-8336-1 0 CVEs
php8.1, php8.3, php8.4, php8.5 vulnerabilities
Aleksey Solovev and Nikita Sveshnikov discovered that PHP improperly handled NUL bytes when preparing SQL queries in the PDO Firebird driver. An attacker could possibly use this issue to perform SQL injection attacks. (CVE-2025-14179) It was discovered that P…
first May 28, 2026