8,437 results · Feed
-
Medium max 6.3USN-8443-1 1 CVE
webpy vulnerability
It was discovered that web.py incorrectly handled sequence names in PostgreSQL insert queries. An attacker could possibly use this issue to perform SQL injection attacks, resulting in the alteration or exposure of database information.
-
UnscoredUSN-8284-1 0 CVEs
gnutls28 vulnerabilities
Joshua Rogers discovered that GnuTLS did not properly handle malformed DTLS handshake fragments in certain cases. A remote attacker could possibly use this issue to obtain sensitive information, or cause a denial of service. (CVE-2026-33845) Haruto Kimura, Os…
first May 20, 2026 -
High max 8.8USN-8438-1 6 CVEs
openimageio vulnerabilities
It was discovered that OpenImageIO incorrectly performed bounds checking when processing SGI files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-43903) It was discovered that OpenImageIO incorrect…
first Jun 16, 2026 -
High max 7.5USN-8412-2 1 CVE
qemu regression
USN-8412-1 fixed vulnerabilities in QEMU. On both Ubuntu 18.04 LTS and Ubuntu 20.04 LTS, the fix for CVE-2024-7409 was incomplete and resulted in a regression that could cause qemu-nbd to crash when a client connected. This update fixes the problem. We apolog…
first Jun 16, 2026 -
UnscoredUSN-8412-1 0 CVEs
qemu vulnerabilities
Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the iSCSI block driver in QEMU incorrectly handled certain responses from an iSCSI server. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of …
first Jun 9, 2026 -
UnscoredUSN-8436-1 0 CVEs
ca-certificates update
The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.86 version of the Mozilla certificate authority bundle.
-
UnscoredUSN-8349-2 0 CVEs
rsync regression
USN-8349-1 fixed vulnerabilities in rsync. The update introduced multiple regressions in rsync functionality. This update fixes the problem. Original advisory details: Calum Hutton discovered that rsync contained a heap-based out-of-bounds read when handling …
first Jun 8, 2026 -
UnscoredUSN-8349-3 0 CVEs
rsync regression
USN-8349-1 fixed vulnerabilities in rsync. Unfortunately that update introduced multiple regressions in rsync functionality. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Calum Hutton discovered that rsync conta…
-
Critical max 9.8USN-8429-1 5 CVEs
fastnetmon vulnerabilities
It was discovered that FastNetMon incorrectly validated prefix lengths when decoding BGP NLRI data. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26…
first Jun 15, 2026 -
Medium max 4.2USN-8175-1 1 CVE
frr vulnerability
It was discovered that FRR did not correctly handle certain network requests. A remote attacker could possibly use this issue to gain unauthorized access to resources.
first Apr 15, 2026 -
Medium max 4.5USN-8428-1 1 CVE
tmux vulnerability
It was discovered that tmux incorrectly handled image cleanup, leading to a use-after-free vulnerability. A local attacker could possibly use this issue to cause tmux to crash, resulting in a denial of service.
-
High max 8.1USN-8427-1 1 CVE
mesa vulnerability
It was discovered that Mesa did not properly validate memory allocation sizes in WebGPU under certain circumstances. An attacker could use this issue to cause Mesa to crash, resulting in a denial of service, or possibly execute arbitrary code.
-
UnscoredUSN-8405-2 0 CVEs
cups regression
USN-8405-1 fixed vulnerabilities in CUPS. The update introduced a regression that cause CUPS to crash when parsing certain large printer PPD files. This update fixes the problem. Original advisory details: Ariel Silver discovered that CUPS incorrectly handled…
-
Medium max 5.9USN-8421-1 3 CVEs
ironic vulnerabilities
Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary file…
first Jun 11, 2026 -
Critical max 9.1USN-8418-1 1 CVE
libcrypt-saltedhash-perl vulnerability
It was discovered that Crypt-SaltedHash incorrectly generated salts using a cryptographically weak pseudo-random number generator. An attacker could possibly use this issue to predict generated salts, leading to a weakening of cryptographic protections.
first Jun 10, 2026 -
UnscoredUSN-8424-1 0 CVEs
ubuntu-kylin-software-center vulnerability
It was discovered that Ubuntu Kylin Software Center incorrectly handled user-supplied input in its D-Bus service. A local attacker could possibly use this issue to gain administrative privileges.
first Jun 11, 2026 -
UnscoredUSN-8417-1 0 CVEs
tomcat9, tomcat10 vulnerabilities
It was discovered that Tomcat did not properly limit the size of WebDAV LOCK and PROPFIND request bodies. A remote attacker could use this issue to cause Tomcat to consume excessive memory, resulting in a denial of service. (CVE-2026-41284) It was discovered …
first Jun 10, 2026 -
Critical max 9.0USN-8306-2 3 CVEs
samba vulnerabilities
USN-8306-1 fixed vulnerabilities in Samba. This update provides the corresponding updates for CVE-2026-3238, CVE-2026-4408, and CVE-2026-4480 in Ubuntu 20.04 LTS. Original advisory details: Asim Viladi Oglu Manizada discovered that Samba incorrectly handled a…
-
UnscoredUSN-6455-2 0 CVEs
exim4 regression
USN-6455-1 fixed vulnerabilities in Exim. The fix for CVE-2023-42117 introduced a regression on Ubuntu 22.04 LTS that resulted in certain connections logging a Taint mismatch error. This update fixes the problem. We apologize for the inconvenience. Original a…
-
UnscoredUSN-8394-1 0 CVEs
yard vulnerability
It was discovered that YARD incorrectly sanitized paths in its built-in documentation server. An attacker could possibly use this issue to read arbitrary files from the server host.
first Jun 5, 2026 -
Low max 2.9USN-8409-1 1 CVE
uriparser vulnerability
It was discovered that uriparser incorrectly handled certain URI strings. An attacker could possibly use this issue to cause uriparser to crash, resulting in a denial of service.
first Jun 9, 2026 -
High max 7.5USN-8156-2 1 CVE
gdk-pixbuf vulnerability
USN-8156-1 fixed a vulnerability in GDK-PixBuf. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that GDK-PixBuf incorrectly handled certain JPEG files. An…
first Jun 9, 2026 -
High max 7.4USN-8413-1 2 CVEs
cyborg vulnerabilities
It was discovered that Cyborg did not properly enforce project ownership in the Accelerator Request (ARQ) API. An authenticated user could possibly use this issue to delete ARQs bound to other projects' instances, resulting in a cross-tenant denial of service…
-
UnscoredUSN-8306-1 0 CVEs
samba vulnerabilities
Asim Viladi Oglu Manizada discovered that Samba incorrectly handled access checks on reparse point operations. An attacker could possibly use this issue to modify reparse point extended attributes on files that should have been read-only. This issue only affe…
first May 26, 2026 -
UnscoredUSN-8398-2 0 CVEs
nginx regression
USN-8398-1 fixed a vulnerability in nginx. The update introduced a regression causing nginx to crash when being used with external modules. This update reverts the fix for CVE-2026-49975 pending further investigation. We apologize for the inconvenience. Origi…
-
Medium max 4.6USN-8044-2 1 CVE
alsa-lib vulnerability
USN-8044-1 fixed a vulnerability in alsa-lib. This update provides the corresponding fix for alsa-lib on Ubuntu 20.04 LTS. Original advisory details: It was discovered that alsa-lib incorrectly handled the topology mixer control decoder. A local attacker coul…
-
UnscoredUSN-8398-1 0 CVEs
nginx vulnerability
It was discovered that nginx incorrectly handled certain cookie headers in the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nginx to consume excessive resources, resulting in a denial of service.
first Jun 8, 2026 -
Critical max 9.9USN-8395-1 10 CVEs
netatalk vulnerabilities
Arjun Basnet discovered that Netatalk incorrectly sanitized user input in its MySQL CNID backend. A remote authenticated attacker could possibly use this issue to conduct SQL injection attacks. (CVE-2026-44047) Arjun Basnet discovered that Netatalk incorrectl…
first Jun 8, 2026 -
High max 8.8USN-8408-1 1 CVE
php-twig vulnerability
It was discovered that Twig did not properly validate PHP callables when using a source policy. An authenticated user could possibly use this issue to execute arbitrary code.
first Jun 8, 2026 -
High max 7.5USN-8406-1 3 CVEs
libnet-cidr-lite-perl vulnerabilities
Dave Rolsky discovered that Net::CIDR::Lite did not properly handle extraneous zero characters at the beginning of an IP address string. A remote attacker could possibly use this issue to bypass access controls that are based on IP addresses. This issue only …
-
Medium max 6.5USN-8405-1 8 CVEs
cups vulnerabilities
Ariel Silver discovered that CUPS incorrectly handled username comparisons during authorization checks. A local attacker could possibly use this issue to gain unauthorized access to restricted operations. (CVE-2026-27447) Asim Viladi Oglu Manizada discovered …
-
Critical max 9.8USN-8387-1 3 CVEs
inetutils vulnerabilities
It was discovered that the Inetutils telnet daemon incorrectly handled the CREDENTIALS_DIRECTORY environment variable. An attacker could possibly use this issue to escalate privileges. (CVE-2026-28372) It was discovered that the Inetutils telnet daemon did no…
first Jun 4, 2026 -
Medium max 5.3USN-8404-1 1 CVE
transmission vulnerability
It was discovered that Transmission had a clickjacking weakness in the browser-facing WebUI and RPC response paths. An attacker could possibly use this issue to trick users into performing unintended actions.
-
Medium max 6.4USN-8402-1 2 CVEs
systemd vulnerabilities
It was discovered that systemd-nspawn incorrectly handled certain optional configuration files. A local attacker could possibly use this issue to escape to the host system and execute arbitrary code. (CVE-2026-40226) It was discovered that systemd-resolved in…
-
High max 8.6USN-8399-1 4 CVEs
pillow vulnerabilities
It was discovered that Pillow incorrectly handled large glyph advance values in fonts. An attacker could possibly use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2026-42308) It was discovered that Pillow incorrectly handled nes…
-
High max 7.3USN-8397-1 1 CVE
jpeg-xl vulnerability
It was discovered that libjxl did not properly handle certain crafted PBM images. An attacker could possibly use this issue to cause libjxl to crash, resulting in a denial of service, or execute arbitrary code.
-
High max 7.8USN-8400-1 1 CVE
poppler vulnerability
It was discovered that poppler incorrectly handled certain malformed PDF tiling patterns in the Splash backend. An attacker could possibly use this issue to execute arbitrary code, obtain sensitive information, or cause a denial of service.
-
Medium max 5.5USN-8119-1 1 CVE
systemd vulnerabilities
It was discovered that systemd incorrectly handled certain cgroup paths. A local attacker could possibly use this issue to cause systemd to crash, resulting in a denial of service. (CVE-2026-29111) It was discovered that the systemd udev component incorrectly…
first Mar 23, 2026 -
UnscoredUSN-8383-1 0 CVEs
tomcat6, tomcat7 vulnerabilities
It was discovered that Tomcat incorrectly handled digest authentication. A remote attacker could possibly use this issue to bypass authentication restrictions. (CVE-2026-43512) It was discovered that Tomcat incorrectly handled case sensitivity in LockOutRealm…
first Jun 4, 2026 -
Medium max 5.5USN-8386-1 2 CVEs
nano vulnerabilities
Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created the ~/.local directory with incorrect permissions. In environments with permissive umask settings, a local attacker could possibly use this issue to inject a malicious launcher file, resu…
first Jun 4, 2026