8,435 results · Feed
-
UnscoredUSN-8334-1 0 CVEs
openjdk-25-crac vulnerabilities
Thomas Beckers discovered that the JAXP component of CRaC JDK 25 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discove…
first May 28, 2026 -
UnscoredUSN-8333-1 0 CVEs
openjdk-21-crac vulnerabilities
Thomas Beckers discovered that the JAXP component of CRaC JDK 21 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discove…
first May 28, 2026 -
UnscoredUSN-8332-1 0 CVEs
openjdk-17-crac vulnerabilities
Thomas Beckers discovered that the JAXP component of CRaC JDK 17 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discove…
first May 28, 2026 -
UnscoredUSN-8331-1 0 CVEs
openjdk-lts vulnerabilities
Thomas Beckers discovered that the JAXP component of OpenJDK 11 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discover…
first May 28, 2026 -
UnscoredUSN-8330-1 0 CVEs
openjdk-8 vulnerabilities
Thomas Beckers discovered that the JAXP component of OpenJDK 8 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discovere…
first May 28, 2026 -
UnscoredUSN-8328-1 0 CVEs
openjdk-21 vulnerabilities
Thomas Beckers discovered that the JAXP component of OpenJDK 21 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discover…
first May 28, 2026 -
UnscoredUSN-8327-1 0 CVEs
openjdk-17 vulnerabilities
Thomas Beckers discovered that the JAXP component of OpenJDK 17 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. (CVE-2026-22016) It was discover…
first May 28, 2026 -
UnscoredUSN-8321-1 0 CVEs
papers vulnerability
It was discovered that Papers incorrectly handled PDF /GoToR actions. If a user were tricked into opening a specially crafted PDF file, an attacker could use this issue to manipulate command lines and possibly execute arbitrary code.
first May 27, 2026 -
UnscoredUSN-8309-1 0 CVEs
libssh2 vulnerability
It was discovered that libssh2 incorrectly handled username and password length values during SSH password authentication. A remote attacker could possibly use this issue to cause a denial of service.
first May 26, 2026 -
UnscoredUSN-8302-1 0 CVEs
nltk vulnerabilities
It was discovered that NLTK incorrectly validated file paths when opening files using the nltk.util module. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-0846) It was discovered that NLTK incorrectly validated file paths…
first May 25, 2026 -
UnscoredUSN-8301-1 0 CVEs
simpleeval vulnerability
Byambadalai Sumiya discovered that SimpleEval did not properly restrict attribute access and callback handling inside a sandbox. An attacker could possibly use this issue to execute arbitrary code.
first May 25, 2026 -
UnscoredUSN-8300-1 0 CVEs
ngtcp2 vulnerability
Zou Dikai discovered that ngtcp2 serialized peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog was enabled, a remote attacker could possibly use this issue to execute arbitrary code.
first May 25, 2026 -
UnscoredUSN-8299-1 0 CVEs
rclone vulnerabilities
It was discovered that Rclone incorrectly handled authorization in the remote control API. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-41176) It was discovered that Rclone incorrectly handled backend instantiation via …
first May 25, 2026 -
UnscoredUSN-8298-1 0 CVEs
dotnet8, dotnet9, dotnet10 vulnerability
Muhammad Abdul Rehman discovered that .NET incorrectly handled certain network requests, leading to a loop with an unreachable exit condition. A remote attacker could possibly use this issue to consume excessive resources, resulting in a denial of service.
first May 25, 2026 -
UnscoredUSN-8295-1 0 CVEs
evince vulnerability
It was discovered that Evince did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially crafted PDF file, an attacker could possibly use this issue to execute arbitrary code.
first May 22, 2026 -
UnscoredUSN-8294-1 0 CVEs
postgresql-14, postgresql-16, postgresql-17, postgresql-18 vulnerabilities
It was discovered that PostgreSQL did not correctly enforce authorization for CREATE TYPE. An attacker could possibly use this issue to execute arbitrary SQL functions. (CVE-2026-6472) It was discovered that PostgreSQL incorrectly handled large user input in …
first May 21, 2026 -
UnscoredUSN-8320-1 0 CVEs
memcached vulnerabilities
It was discovered that Memcached's SASL password database authentication had a timing side channel when handling username and password data. A remote attacker could possibly use this issue to obtain sensitive information.
first May 27, 2026 -
UnscoredUSN-8293-1 0 CVEs
bind9 vulnerabilities
Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. (CVE-2026-3039) Shuhan Zhang discovered that…
first May 21, 2026 -
UnscoredUSN-8282-2 0 CVEs
unbound vulnerabilities
USN-8282-1 fixed vulnerabilities in Unbound. This update provides the corresponding updates for CVE-2026-41292 in Ubuntu 18.04 LTS and Ubuntu 20.04 LTS and CVE-2026-42959, CVE-2026-42960 in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.0…
first Jun 2, 2026 -
UnscoredUSN-8288-1 0 CVEs
bubblewrap vulnerability
It was discovered that Bubblewrap incorrectly handled the sandbox setup phase when installed in setuid mode. A local attacker could possibly use this issue to bypass sandbox restrictions.
first May 20, 2026 -
UnscoredUSN-8283-1 0 CVEs
rsync vulnerabilities
Calum Hutton discovered that rsync contained a heap-based out-of-bounds read when handling file transfers. A remote attacker with read access to an rsync server could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 …
first May 20, 2026 -
UnscoredUSN-8282-1 0 CVEs
unbound vulnerabilities
Andrew Griffiths discovered that Unbound did not properly handle certain DNSCrypt packets. A remote attacker could possibly use this issue to cause Unbound to crash, resulting in a denial of service. (CVE-2026-32792) Qifan Zhang discovered that Unbound incorr…
first May 20, 2026 -
UnscoredUSN-8268-1 0 CVEs
dnsmasq vulnerabilities
Andrew S. Fasano, Royce M, and Hugo Martinez Ray discovered that Dnsmasq did not allocate the necessary space to store domain names in some contexts. An attacker could possibly use this issue to write out-of-bounds, and could cause a denial of service or exec…
first May 12, 2026 -
UnscoredUSN-8253-2 0 CVEs
postfix vulnerability
USN-8253-1 fixed a vulnerability in Postfix. This update provides the corresponding fix for Postfix on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: Kamil Frankowicz discovered that Postfix incorrectly …
first Jun 3, 2026 -
UnscoredUSN-8253-1 0 CVEs
postfix vulnerability
Kamil Frankowicz discovered that Postfix incorrectly handled certain enhanced status codes. A remote attacker could possibly use this issue to cause Postfix to crash, resulting in a denial of service.
first May 7, 2026 -
UnscoredUSN-8239-1 0 CVEs
apache2 vulnerabilities
Bartlomiej Dmitruk and Stanislaw Strzalkowski discovered that Apache HTTP Server incorrectly handled certain memory operations when using the HTTP/2 protocol. A remote attacker could use this issue to cause Apache HTTP Server to crash, resulting in a denial o…
first May 6, 2026 -
UnscoredUSN-8237-1 0 CVEs
webkit2gtk vulnerabilities
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting a…
first May 6, 2026 -
UnscoredUSN-8233-2 0 CVEs
nghttp2 vulnerability
USN-8233-1 fixed a vulnerability in nghttp2. This update provides the corresponding update for Ubuntu 26.04 LTS. Original advisory details: Andrew MacPherson discovered that nghttp2 did not properly validate internal state when the session termination API was…
first May 6, 2026 -
UnscoredUSN-8233-1 0 CVEs
nghttp2 vulnerability
Andrew MacPherson discovered that nghttp2 did not properly validate internal state when the session termination API was called. A remote attacker could possibly use this issue to cause nghttp2 to crash, resulting in a denial of service.
first May 5, 2026 -
UnscoredUSN-8222-1 0 CVEs
openssh vulnerabilities
Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol (-O) option. This could result in certain files being installed setuid or setgid, contrary to expectations. (CVE-2026-35385) Florian Kohnhäuser discover…
first Apr 29, 2026 -
UnscoredUSN-8219-1 0 CVEs
ujson vulnerabilities
Cameron Criswell discovered that UltraJSON contained a memory leak that would occur when parsing large integers. An attacker could possibly use this issue to cause UltraJSON to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS…
first Apr 28, 2026 -
UnscoredUSN-8216-1 0 CVEs
dotnet10 vulnerabilities
Ludvig Pedersen discovered that the System.Security.Cryptography.Xml library in .NET incorrectly handled certain XML inputs. An attacker could possibly use this issue to consume excessive resources, resulting in a denial of service. (CVE-2026-33116, CVE-2026-…
first Apr 28, 2026 -
UnscoredUSN-8210-1 0 CVEs
nginx vulnerabilities
It was discovered that the nginx ngx_mail_auth_http_module module incorrectly handled certain requests. An attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-27651) It was discovered that the nginx ngx_…
first Apr 27, 2026 -
UnscoredUSN-8214-1 0 CVEs
nltk vulnerability
It was discovered that NLTK incorrectly handled file extraction when opening a maliciously crafted zip file. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code.
first Apr 28, 2026 -
UnscoredUSN-8211-1 0 CVEs
pillow vulnerability
It was discovered that Pillow incorrectly handled certain FITS images. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service.
first Apr 27, 2026 -
UnscoredUSN-8208-1 0 CVEs
haproxy vulnerability
Martino Spagnuolo discovered that HAProxy did not check received body lengths in the HTTP/3 parser. A remote attacker could possibly use this issue to perform a request smuggling attack and obtain sensitive information.
first Apr 27, 2026 -
UnscoredUSN-8202-3 0 CVEs
jq regression
USN-8202-1 fixed vulnerabilities in jq. The update caused a regression for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that jq did not correctly handle …
first May 21, 2026 -
UnscoredUSN-8202-2 0 CVEs
jq vulnerabilities
USN-8202-1 fixed vulnerabilities in jq. This update provides the corresponding update to Ubuntu 26.04 LTS. Original advisory details: It was discovered that jq did not correctly handle certain string concatenations. An attacker could possibly use this issue t…
first Apr 28, 2026 -
UnscoredUSN-8195-3 0 CVEs
packagekit vulnerability
USN-8195-1 fixed a vulnerability in PackageKit. This update provides the corresponding fix to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PackageKit incorrectly handled certain transactions. A loc…
first Apr 29, 2026 -
UnscoredUSN-8182-1 0 CVEs
ruby-rack vulnerabilities
Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25…
first Apr 17, 2026