8,409 results · Feed
-
Critical max 9.1USN-8983-1 1 CVE
golang-github-gin-contrib-cors vulnerability
It was discovered that the Gin CORS middleware incorrectly handled wildcards at the end of origin strings. A remote attacker could possibly use this issue to bypass the configured origin restrictions.
first Nov 3, 2026 -
UnscoredUSN-8982-1 1 CVE
feh vulnerability
It was discovered that feh incorrectly handled certain IPC messages from a client pretending to be the Enlightenment window manager, leading to an integer overflow. An attacker could possibly use this issue to cause feh to crash, resulting in a denial of serv…
first Nov 3, 2026 -
High max 7.8USN-8981-1 1 CVE
e17 vulnerability
It was discovered that the enlightenment_sys helper in Enlightenment incorrectly handled certain pathnames. A local attacker could possibly use this issue to gain administrator privileges.
first Nov 3, 2026 -
Medium max 5.5USN-8988-1 1 CVE
rear vulnerability
It was discovered that Relax-and-Recover created a world-readable initrd when GRUB_RESCUE was enabled. A local attacker could possibly use this issue to obtain sensitive information.
first Nov 3, 2026 -
Medium max 5.4USN-8985-1 1 CVE
libnet-easytcp-perl vulnerability
It was discovered that Net::EasyTCP used the built-in Perl rand() function to generate encryption keys when no strong randomization module was present. An attacker could possibly use this issue to predict the keys and obtain sensitive information.
first Nov 3, 2026 -
UnscoredUSN-8979-1 2 CVEs
deluge vulnerabilities
It was discovered that the web UI in Deluge did not protect against cross- site request forgery. A remote attacker could possibly use this issue to trick a user into installing a malicious plugin, resulting in the execution of arbitrary code. (CVE-2017-7178) …
first Nov 3, 2026 -
High max 7.5USN-8978-1 1 CVE
cakephp vulnerability
Dawid Golunski discovered that CakePHP incorrectly trusted the CLIENT-IP HTTP header when determining the client IP address. A remote attacker could possibly use this issue to spoof their IP address.
first Nov 3, 2026 -
UnscoredUSN-8976-1 1 CVE
apt-cacher vulnerability
It was discovered that Apt-Cacher did not properly handle encoded newline characters in requests. A remote attacker could possibly use this issue to perform HTTP response splitting attacks.
first Nov 3, 2026 -
Medium max 6.3USN-8973-1 1 CVE
libmspack vulnerability
It was discovered that libmspack did not properly initialize pointers when handling errors while reading KWAJ archive headers. An attacker could possibly use this issue to cause libmspack to crash, resulting in a denial of service, or execute arbitrary code.
first Nov 3, 2026 -
High max 8.3USN-8993-1 1 CVE
sogo vulnerability
It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.
first Nov 3, 2026 -
Critical max 9.8USN-8992-1 1 CVE
shapelib vulnerability
It was discovered that the shpsort utility in Shapelib incorrectly handled certain inputs, leading to a double free. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.
first Nov 3, 2026 -
UnscoredUSN-8977-1 2 CVEs
bitlbee vulnerabilities
It was discovered that BitlBee incorrectly handled file transfer connections that expired when built with libpurple. A remote attacker could possibly use this issue to cause BitlBee to crash, resulting in a denial of service, or possibly execute arbitrary cod…
first Nov 3, 2026 -
High max 8.4USN-8994-1 9 CVEs
vips vulnerabilities
It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. Thi…
first Nov 3, 2026 -
Critical max 9.8USN-8986-1 1 CVE
libphp-swiftmailer vulnerability
Dawid Golunski discovered that Swift Mailer did not properly sanitize e-mail addresses in the mail transport. A remote attacker could possibly use this issue to pass extra parameters to the mail command and execute arbitrary code.
first Nov 3, 2026 -
UnscoredUSN-8984-1 1 CVE
jabberd2 vulnerability
It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. A remote attacker could possibly use this issue to bypass authentication.
first Nov 3, 2026 -
High max 8.4USN-8980-1 3 CVEs
dmitry vulnerabilities
It was discovered that DMitry incorrectly handled long arguments, leading to a stack-based buffer overflow. An attacker could possibly use this issue to cause DMitry to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-793…
first Nov 3, 2026 -
Medium max 6.1USN-8971-1 1 CVE
gnome-shell vulnerability
It was discovered that GNOME Shell did not properly validate icon dimensions when processing icons from a remote search provider. An attacker could possibly use this issue to cause GNOME Shell to crash, resulting in a denial of service, or expose sensitive in…
first Nov 3, 2026 -
High max 7.5USN-8990-1 1 CVE
ruby-sprockets vulnerability
It was discovered that Sprockets incorrectly handled certain specially crafted requests when the Sprockets server was used in production. A remote attacker could possibly use this issue to access files outside of the application's root directory.
first Nov 3, 2026 -
High max 7.5USN-8972-1 2 CVEs
haproxy vulnerabilities
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353) It was discovered that HAPr…
first Nov 3, 2026 -
High max 7.5USN-8989-1 13 CVEs
ruby-rack vulnerabilities
Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. (CVE-2026-26961) William T. Nelson discovered that Rack did not handle multipart headers cor…
first Nov 3, 2026 -
High max 8.2USN-8974-1 8 CVEs
pcre2 vulnerabilities
It was discovered that PCRE2 did not correctly manage memory when processing certain patterns. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS…
first Nov 3, 2026 -
High max 8.1USN-8969-1 18 CVEs
bind9 vulnerabilities
It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. T…
-
UnscoredUSN-8966-1 2 CVEs
linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial vulnerabilities
Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memor…
-
UnscoredUSN-8964-1 0 CVEs
linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SCSI subsystem; - Network file system (NFS) client; (CVE-2022-49082, CVE-2025…
-
Critical max 9.8
linux, linux-aws, linux-azure, linux-azure-6.8, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oem-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V arc…
first Apr 23, 2025 -
Critical max 9.2USN-8933-1 12 CVEs
rabbitmq-server vulnerabilities
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LT…
first Oct 15, 2026 -
Critical max 9.1USN-8932-1 9 CVEs
curl vulnerabilities
Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 2…
first Oct 14, 2026 -
UnscoredUSN-8970-1 0 CVEs
gvfs vulnerabilities
It was discovered that GVfs did not properly validate data returned by an SFTP server. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-84267) It was discovered that GVfs did not properly validate the size of replies …
-
UnscoredUSN-8968-1 0 CVEs
linux vulnerabilities
It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3640) Several security issue…
-
UnscoredUSN-8967-1 0 CVEs
linux-aws vulnerability
Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memor…
-
UnscoredUSN-8965-1 0 CVEs
linux-bluefield vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Ethernet bonding driver; - Network drivers; - SCSI subsystem; - F2FS file sys…
-
Critical max 9.1USN-8927-2 18 CVEs
curl vulnerabilities
USN-8927-1 fixed vulnerabilities in curl. This update provides the corresponding fixes for Ubuntu 26.10. Original advisory details: It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker …
first Oct 19, 2026 -
Critical max 9.1USN-8927-1 18 CVEs
curl vulnerabilities
It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-107928) Maksim discovered that curl did not correctly inclu…
first Oct 14, 2026 -
Critical max 9.8USN-8034-2 115 CVEs
linux-nvidia-tegra-igx vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Nios II architecture; - Sun Sparc architecture; - User-Mode Linux (UML); - x8…
first Feb 17, 2026 -
Critical max 10.0USN-7585-6 32 CVEs
linux-bluefield vulnerabilities
It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312) Several security issues were…
first Jul 3, 2025 -
Critical max 10.0USN-7585-2 32 CVEs
linux-aws-fips, linux-gcp-fips vulnerabilities
It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312) Several security issues were…
first Jun 19, 2025 -
High max 7.8USN-7554-3 11 CVEs
linux-fips vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Block layer subsystem; - Clock framework and drivers; - GPU drivers; - Parpor…
first Jun 4, 2025 -
High max 7.8USN-7554-2 11 CVEs
linux-aws, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Block layer subsystem; - Clock framework and drivers; - GPU drivers; - Parpor…
first Jun 4, 2025 -
Critical max 10.0USN-7593-1 194 CVEs
linux-hwe-5.15 vulnerabilities
Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rougue device and possibly execute arbitrary code. (CVE-2024-8805) It was disc…
first Jun 24, 2025 -
Critical max 10.0USN-7585-3 32 CVEs
linux-azure-fips, linux-fips vulnerabilities
It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312) Several security issues were…
first Jun 25, 2025