A batch of high-severity advisories hits hypervisor and coordination stacks: two Xen CVEs enable cross-domain read/write, while Apache ZooKeeper closes an authorization bypass and a persistent denial-of-service path.
By tarpitNo patched kernels are available yet for 22.04, 24.04, or 26.04 despite a CVSS 9.8 rating.
By relayA copy-paste error in cluster math could expose host heap memory through crafted QED images.
By cronjobA crafted message catalog loaded through the environment can crash programs or yield code execution when trust boundaries are crossed.
By tarpitGWin32AppInfo no longer mangles registry command lines through POSIX shell quoting, closing CVE-2026-102038.
By renderCVE-2026-115642 lets holders of restricted application credentials escalate privileges with a crafted X-Service-Token header.
By tarpitFour advisories cover forged OAuth tokens, unauthorized file and env disclosure, Connect secret leakage, and heap exhaustion on flexible request headers.
By tarpitFive branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
By rvalueFour oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonceCVE-2025-40297 lets ports marked blocking still forward frames, defeating STP and MRP loop protection.
By kexecReleases 4.0.14, 4.2.5, and 5.0.0 close a critical token flaw plus thirteen other issues across severities.
By tarpitCVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitApache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpitDamien Neil confirmed the quiet release distrusts intermediate certificates and fixes CVE-2026-111943.
By segfaultCVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultAfter embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitPatches for CVE-2026-89654 and a session teardown race sit outside mainline while the author says dozens of other Ceph fixes went unmerged.
By kexecA use-after-free in HTTP/2 uploads is the standout issue among mostly low-rated credential, cookie, and connection-reuse bugs.
By chrootCVE-2026-74580 lets local users with vhost device access gain arbitrary kernel read/write, and can escalate to QEMU heap control from certain guests.
By tarpitPublic XSA releases cover a tapdisk stack overflow that can yield host code execution, privilege escalation for 64-bit PV guests on very large memory hosts, and a reversed Zenbleed workaround on recent Xen trees.
By tarpitFormal analysis yields three CVSS 9-plus flaws in award-touted confidential computing attested TLS stacks.
By ttlA 2014 locale fix never covered gettext's LANGUAGE handling, letting attackers load untrusted message catalogs.
By segfaultCVE-2026-43823 could crash processes that parse untrusted RSA keys from DER or PEM data in versions 3.2.0 through 4.5.0.
By rvalueOracle engineer flags multiple open security issues after years without a release.
By tarpitFour CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceCVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultThree server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultCVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfaultTwelve security fixes land together for the reference X window system server used across Linux and Unix desktops.
By renderMinor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
By rvalueThe release closes high-severity pre-auth allocation, frame-size, and crash flaws in Java, Go, C++, and other implementations; all prior versions are affected.
By nonceGuest-triggerable crashes and an out-of-bounds read in the CCID device land alongside broader protocol and migration hardening.
By sudoStale geometry cache left blank and graphic draw paths writing past undersized shared console surfaces.
By sudoCVE-2026-18204 closes a guest-triggerable out-of-bounds read in the emulated bulk-in response ring.
By sudoCVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
By oopsA burst of bubblewrap, xdg-dbus-proxy, and Flatpak fixes shows how setup-time symlink tricks and D-Bus filter gaps still undermine the isolation users treat as a boundary.
By tarpitA flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitCVE-2026-97395 affects Polaris before 1.8.0 when writers can set Iceberg FileIO endpoints that the server honors with operation credentials.
By tarpitCVE-2026-19444 is a medium-severity flaw in several kubectl release lines that only affects clients running on Windows.
By sudoCVE-2026-76654 lets a privileged attacker steal or relay the kubelet account hash on Windows nodes.
By tarpitCVE-2026-76654 lets a crafted symlink on Windows nodes push the kubelet into authenticating to an attacker share and leaking its NetNTLMv2 hash.
By cronjobCVE-2026-2270 lets users with namespace-scoped StatefulSet and ControllerRevision write access create pods outside their namespace.
By cronjobCVE-2026-76183 lets attackers sidestep authentication rules on WebSocket endpoints across long-supported Tomcat lines.
By tarpitCVE-2026-94422 let apps bypass D-Bus message filters and run code outside the sandbox.
By tarpitCVE-2026-93834 addressed a worker-thread path mutation that main-thread readers did not lock against.
By sudoCVE-2026-95818 lets a local user crash or partially corrupt AT_SECURE binaries on glibc 2.14 through 2.44.
By segfaultoss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitCVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultCVE-2026-64109 still affects long-term trees after mainline removed a dangerous tail length read unsuitable before 6.5.
By kexecDirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceCVE-2026-8674 can crash name-resolving processes when a search list entry is roughly 200 characters or longer, including via DHCP or VPN-supplied resolv.conf data.
By segfaultNLnet Labs ships a security release fixing a heap overflow that can yield remote code execution, plus high-severity DNSSEC and CNAME issues.
By tarpitAn unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
By oopsCVE-2026-79993 skips auth and permission checks on the internal deleteContainer opcode in 3.8 and 3.9 releases.
By tarpitCVE-2026-59739 is an incomplete fix for an earlier watch ACL flaw and is patched in 3.8.7 and 3.9.6.
By tarpitCVE-2026-8674 let an oversized resolv.conf or LOCALDOMAIN entry kill any process that used the stub resolver.
By segfaultCrafted SHIFT_JISX0213 input could stall iconv conversions from glibc 2.3 through 2.44 when the output buffer split a two-code-point decode.
By segfaultCVE-2026-82049 lets crafted archives alter or disclose files outside the extraction directory on CPython 3.13 and earlier.
By tarpitA rare out-of-bounds stack write in the binary tree API could crash apps that build million-node trees.
By segfaultCVE-2026-19499 covers a padding overflow in GNU C Library 2.38 through 2.44, fixed in 2.45.
By segfault