Canonical Ubuntu Linux Linux Operating System

CVE-2026-53586 libgit2 credentials leak via HTTP redirect (before 1.8.6/1.9.5)
CVE-2026-53586 6.5 - Medium - August 20, 2026

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.

Information Disclosure

Memory Exhaustion in libgit2 <1.8.6/1.9.5 via Malicious delta
CVE-2026-53585 5.3 - Medium - August 20, 2026

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-controlled res_sz value parsed by hdr_sz from a delta object header and passes that amount to git__malloc before validating delta instructions. Malicious pack data supplied through git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local attacker-supplied repository can use a very small multi-level OFS_DELTA chain to retain extremely large allocations and exhaust memory. This issue is fixed in versions 1.8.6 and 1.9.5.

Allocation of Resources Without Limits or Throttling

libgit2 Heap OOB Walk: smart_pkt.c <1.8.6/1.9.5
CVE-2026-53587 7.5 - High - August 20, 2026

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.

Improper Input Validation

libgit2 submodule path traversal before 1.8.6/1.9.5
CVE-2026-53584 4.3 - Medium - August 20, 2026

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.

Directory traversal

accountsservice LPE via sed injection in PAM language script v<23.13.9
CVE-2026-61898 7.8 - High - August 20, 2026

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

Shell injection

Local PrivEsc via Ubuntu AccountsService 23.13.9-8ubuntu7
CVE-2026-61897 7.8 - High - August 20, 2026

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

Improper Check for Dropped Privileges

Vim netrw Arbitrary Vimscript via Quote Breakout in Mark/Unmark
CVE-2026-43961 7.8 - High - August 19, 2026

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Code Injection

libheif <1.23.1: Tile OOB Read via Offset Wrap in uncompressed HEIF
CVE-2026-62292 8.7 - High - August 18, 2026

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1.

Out-of-bounds Read

libheif <1.23.1: Clean Aperture box causes zero-width tiling (HEIF/AVIF)
CVE-2026-62289 4.3 - Medium - August 18, 2026

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF or AVIF file containing a clean aperture box can reduce an image dimension to zero and crash or corrupt tiling results when heif_image_handle_get_image_tiling(handle, 1, &tiling) is called. ImageItem::get_heif_image_tiling() returns already transformed dimensions, and process_image_transformations_on_tiling() applies the clean aperture transformation again. The second application passes zero to Box_clap::left_rounded(0), where image_width minus one underflows and constructs Fraction(0xFFFFFFFF, 2). Debug builds reach an assertion and abort, while release builds can return a corrupt crop and zero-width tiling result. The affected implementation spans libheif/image-items/image_item.cc, libheif/context.cc, and libheif/box.cc. This issue is fixed in version 1.23.1.

Integer underflow

Unbounded Heap Allocation in libheif <1.23.0 due to msf1 Brand
CVE-2026-50142 7.5 - High - August 18, 2026

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-size samples, so fixed-size mode accepts an attacker-controlled sample_count without a bound. In libheif/sequences/track.cc, Track::load() also adds current_sample_idx and samples_per_chunk in 32-bit arithmetic, allowing the consistency check to be bypassed by wraparound. The resulting values reach the Chunk::Chunk() allocation path, which can consume gigabytes of memory and crash or stall the process through memory exhaustion. This issue is fixed in version 1.23.0.

Integer Overflow or Wraparound

Samba CTDB Protocol Packet Bounds Checking Flaw (CVE-2026-58224)
CVE-2026-58224 6.5 - Medium - August 14, 2026

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

Missing Support for Integrity Check

PostgreSQL refint Type Confusion Exec as OS User pre-18.5
CVE-2026-14671 8.8 - High - August 13, 2026

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Object Type Confusion

PostgreSQL auth bypass via logical decoding plugin DLopen in 18.x/17.x
CVE-2026-6471 7.2 - High - August 13, 2026

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

AuthZ

PostgreSQL DDL Auth Bypass Enables DoS on ALTER/ DROP Type (pre-18.5)
CVE-2026-6470 4.3 - Medium - August 13, 2026

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

AuthZ

PostgreSQL <18.5: ALTER TYPE Ownership Bug Enables Priv Escalation
CVE-2026-6469 3.8 - Low - August 13, 2026

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Incorrect Ownership Assignment

PostgreSQL Before 18.5: Untrusted Data Inclusion via psql COPY Error
CVE-2026-6464 8.1 - High - August 13, 2026

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Inclusion of Functionality from Untrusted Control Sphere

Untrusted Data Inclusion in pg_dump (PostgreSQL <18.5) Enables Code Exec via psql \restrict
CVE-2026-18408 8.8 - High - August 13, 2026

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Inclusion of Functionality from Untrusted Control Sphere

Heap Buffer Overflow in PostgreSQL pg_dump (v<18.5) Enables OS-Level RCE
CVE-2026-19385 8.8 - High - August 13, 2026

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Heap-based Buffer Overflow

PostgreSQL ECPG Int Uflow 18.5 allows temp DoS via bytea
CVE-2026-16241 3.8 - Low - August 13, 2026

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Integer underflow

PostgreSQL ascii() buffer over-read before 18.5/17.11/16.15/15.19/14.24
CVE-2026-18024 4.3 - Medium - August 13, 2026

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Buffer Over-read

PostgreSQL <18.5 Type Confusion Enables OS Exec via Cursor Re-Creation
CVE-2026-16239 8.8 - High - August 13, 2026

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Object Type Confusion

PostgreSQL <18.5 Type Confusion in pg_restore_attribute_stats() risks OS exec
CVE-2026-16238 8.8 - High - August 13, 2026

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

Object Type Confusion

PostgreSQL fuzzystrmatch Integer Wraparound Enables OS Code Exec (18.5)
CVE-2026-15742 8.8 - High - August 13, 2026

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Integer Overflow or Wraparound

SQL Injection via EXTRACT() Deparse in PostgreSQL < 18.5
CVE-2026-15741 8.8 - High - August 13, 2026

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

SQL Injection

PostgreSQL GSSAPI Integrity Leak in 17/18 (<=17.10,<=18.4)
CVE-2026-14681 4.2 - Medium - August 13, 2026

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

PostgreSQL 14-18: internal type confusion can execute OS code
CVE-2026-14680 8.8 - High - August 13, 2026

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Object Type Confusion

PostgreSQL <18.5 ArgNameMatch Stack Buffer Overflow via OUT Param Count
CVE-2026-14679 8.2 - High - August 13, 2026

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Stack Overflow

PostgreSQL Buffer OverRead in pg_trgm Index picksplit (18.5)
CVE-2026-14678 4.3 - Medium - August 13, 2026

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Buffer Over-read

PostgreSQL 32-bit pltcl/plperl WRAPAROUND (18.5/17.11/16.15/15.19/14.24)
CVE-2026-14677 8.8 - High - August 13, 2026

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Integer Overflow or Wraparound

PostgreSQL 18.x (pre18.5) Heap B.O. in pg_stat_statements Enables OS Exec
CVE-2026-14676 8.8 - High - August 13, 2026

Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

Heap-based Buffer Overflow

PostgreSQL 14-18: Untrusted Search Path in amcheck leads to privilege escalation
CVE-2026-14673 3.8 - Low - August 13, 2026

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

Untrusted Path

Heap buffer overflow in PostgreSQL plperl (pre-18.5) allows OS exec
CVE-2026-14670 8.8 - High - August 13, 2026

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Heap-based Buffer Overflow

PostgreSQL 1618 SCRAM Iteration Count Disclosure via Auth Challenge
CVE-2026-14672 5.3 - Medium - August 13, 2026

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.

Observable Response Discrepancy

PostgreSQL to_char(timestamptz) Heap Buffer Overflow via TZ before 18.5
CVE-2026-14669 8.8 - High - August 13, 2026

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Heap-based Buffer Overflow

PostgreSQL ctid estimator type confusion allows memory leakage (before 18.5)
CVE-2026-14668 8.1 - High - August 13, 2026

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Object Type Confusion

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership
CVE-2026-14666 4.2 - Medium - August 13, 2026

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Improper Preservation of Consistency Between Independent Representations of Shared State

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text
CVE-2026-14664 8.8 - High - August 13, 2026

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Heap-based Buffer Overflow

Cleartext storage in PostgreSQL pgcrypto disabled ciphers
CVE-2026-14663 6.5 - Medium - August 13, 2026

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Cleartext Storage in a File or on Disk

Integer wraparound in PostgreSQL tsvector and tsquery data type functions
CVE-2026-14662 8.8 - High - August 13, 2026

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Integer Overflow or Wraparound

Aug 2026: .NET Elevation of Privilege Vulnerability
CVE-2026-62909 7.8 - High - August 11, 2026

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

Unchecked Return Value

Aug 2026: .NET Information Disclosure Vulnerability
CVE-2026-62900 5.9 - Medium - August 11, 2026

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.

Improper Removal of Sensitive Information Before Storage or Transfer

Aug 2026: .NET Denial of Service Vulnerability
CVE-2026-62901 7.5 - High - August 11, 2026

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

Unchecked Input for Loop Condition

Aug 2026: .NET Security Feature Bypass Vulnerability
CVE-2026-62899 5.9 - Medium - August 11, 2026

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

HTTP Request Smuggling

systemd-machined 259+ Unprivileged Kill Any Process via Desktop GUI
CVE-2026-15060 4.7 - Medium - August 10, 2026

When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected

Authorization

Local PrivEsc via System Group Addition in systemd-homed 245
CVE-2026-16742 6.7 - Medium - August 10, 2026

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

Improper Verification of Cryptographic Signature

systemdoomd 250260 Path Traversal Allows Process Termination
CVE-2026-15059 5.5 - Medium - August 10, 2026

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

Directory traversal

Linux kernel ARC EMAC: interrupt race during probe teardown
CVE-2026-64587 7 - High - August 06, 2026

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe should not see interrupt delivery in the usual case. However, hardware may still present stale or latched interrupt status left by firmware or the bootloader. If probe later unwinds after devm_request_irq() has installed the handler, such a stale interrupt can still reach arc_emac_intr() during teardown and race with release of the associated net_device. Avoid that window by putting the device into a known quiescent state before requesting the IRQ: disable all EMAC interrupt sources and clear any pending EMAC interrupt status bits. This keeps the change hardware-focused and minimal, while preventing spurious IRQ delivery from leftover state.

OpenVPN 2.5.x-2.7.x TLS-crypt-v2 Client Key Extraction Mem Leak (remote DOS)
CVE-2026-12932 - July 30, 2026

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Memory Leak

Use-After-Free in OpenVPN 2.6.0-2.6.20 & 2.7.1-2.7.4 TLS
CVE-2026-12996 - July 30, 2026

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

Dangling pointer

OpenVPN 2.1.0-2.6.20 / 2.7_alpha1-2.7.4 Off-by-One in NTLM Proxy Auth
CVE-2026-11771 - July 30, 2026

OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server

off-by-five