Recent CVEs — the feed our matcher runs against your servers

kmod update

kmod has been updated to block loading of the algif_aead kernel module.

kmod update

kmod has been updated to block loading of the algif_aead kernel module.

Affects (Ubuntu noble): kmodkmodlibkmod-devlibkmod2

zuluCrypt vulnerability

zuluCrypt could be made to run programs as an administrator.

Affects (Ubuntu noble): zulucryptlibzulucrypt-devlibzulucrypt-exe-devlibzulucrypt-exe1.2.0libzulucrypt-plugins

Python marshmallow vulnerabilities

Several security issues were fixed in Python marshmallow.

Affects (Ubuntu noble): python-marshmallowpython3-marshmallowpython3-marshmallow-doc

Roundcube Webmail vulnerabilities

Several security issues were fixed in Roundcube Webmail.

Affects (Ubuntu noble): roundcuberoundcuberoundcube-coreroundcube-mysqlroundcube-pgsql

Linux kernel (BlueField) vulnerabilities

Several security issues were fixed in the Linux kernel.

OpenSSH vulnerabilities

Several security issues were fixed in OpenSSH.

Affects (Ubuntu noble): opensshopenssh-clientopenssh-serveropenssh-sftp-serveropenssh-tests

PackageKit vulnerability

PackageKit could be made to install packages as the administrator.

wheel vulnerability

wheel could be made to crash or run programs as your login if it opened a specially crafted file.

Affects (Ubuntu noble): wheelpython-wheel-commonpython3-wheelpython3-wheel-whl

Tornado vulnerabilities

Several security issues were fixed in Tornado.

UltraJSON vulnerabilities

Several security issues were fixed in UltraJSON.

Affects (Ubuntu noble): ujsonpython3-ujson

Linux kernel (Low Latency NVIDIA) vulnerabilities

Several security issues were fixed in the Linux kernel.

Affects (Ubuntu noble): linux-nvidia-lowlatencylinux-buildinfo-6.8.0-1051-nvidia-lowlatencylinux-buildinfo-6.8.0-1051-nvidia-lowlatency-64klinux-cloud-tools-nvidia-lowlatencylinux-cloud-tools-nvidia-lowlatency-6.8

follow-redirects vulnerabilities

Several security issues were fixed in follow-redirects.

Rack::Session vulnerability

Rack::Session could allow unintended access to network services.

Dovecot regression

USN-8136-1 introduced a regression in Dovecot

Affects (Ubuntu noble): dovecotdovecot-auth-luadovecot-coredovecot-devdovecot-gssapi

python-cryptography vulnerability

python-cryptography could be made to expose sensitive information over the network.

NLTK vulnerability

NLTK could be made to crash or run programs as your login if it opened a specially crafted zip file.

Affects (Ubuntu noble): nltkpython3-nltk

.NET vulnerabilities

Several security issues were fixed in .NET.

.NET vulnerability

.NET could be made to crash or run programs as an administrator.

Affects (Ubuntu noble): dotnet10aspnetcore-runtime-10.0aspnetcore-runtime-dbg-10.0aspnetcore-targeting-pack-10.0dotnet-apphost-pack-10.0

jq vulnerabilities

Several security issues were fixed in jq.

Vim vulnerabilities

Several security issues were fixed in Vim.

Affects (Ubuntu noble): vimvimvim-athenavim-commonvim-doc

authd vulnerability

authd could be made to escalate privileges.

CVE-2026-6337

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accide

CVE-2026-40514

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from Sys

CVE-2026-30350

An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

CVE-2026-7130

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_category. Executing a manipulation of t

CVE-2026-7129

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /index.php?page=categories. Performing a manipulation of the argumen

CVE-2026-7128

A security vulnerability has been detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=save_type. Such manipulati

CVE-2026-7127

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_receiving. This manipulation of th

CVE-2026-7126

A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_category. The manipulation of the argument

CVE-2026-6265

Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1

CVE-2026-41081

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache S

CVE-2026-40557

Improper Certificate Validation via Global SSL Context Downgrade in Apache Storm Prometheus Reporter Versions Affected: from 2.6.3 to 2.8.6 Description:  In production deployments where an admini

CVE-2026-32688

Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion. Plug.Cowboy.Conn.conn/1 in lib

CVE-2025-15626

Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application

CVE-2026-7125

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipul

CVE-2026-7124

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Exec

CVE-2026-7123

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the a

CVE-2026-7040

Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leadi

CVE-2026-7122

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the arg

CVE-2026-7121

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument w

CVE-2026-7119

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command inject

CVE-2026-7118

A security vulnerability has been detected in code-projects Employee Management System 1.0. The affected element is an unknown function of the file 370project/cancel.php. The manipulation of the argum

CVE-2026-7117

A weakness has been identified in code-projects Employee Management System 1.0. Impacted is an unknown function of the file 370project/approve.php. Executing a manipulation of the argument id/token ca

CVE-2026-7116

A security flaw has been discovered in code-projects Employee Management System 1.0. This issue affects some unknown processing of the file 370project/mark.php. Performing a manipulation results in cr

CVE-2026-5943

Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not prop

CVE-2026-5942

Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated objects and crash the program.

CVE-2026-5941

Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during inter

CVE-2026-5940

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

CVE-2026-5939

A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting in an arbitrary code execution.