CVE-2026-105923 is a vulnerability in the qtbase-opensource-src-gles component where a malicious SVG file can trigger an integer overflow, leading to a null-pointer dereference in the VectorImage QML Type. This flaw has a medium severity score of 6.7 and affects multiple specific versions of the qtbase-opensource-src-gles package. The vulnerability requires local access to exploit and involves user interaction. No known exploits are reported in the wild.
NLnet Labs Unbound up to and including version 1.26.1 contains a vulnerability identified as CVE-2026-109125. The vulnerability has a medium severity with a CVSS score of 5.3. It involves an observable issue that impacts the integrity of the system but does not affect confidentiality or availability. The affected versions include multiple specific builds primarily related to Ubuntu distributions. No public exploit code or known exploitation in the wild has been reported.
NLnet Labs Unbound versions from 1.22.0 up to and including 1.26.1 contain a vulnerability identified as CVE-2026-97206. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, and affects multiple Ubuntu package versions. The flaw does not impact confidentiality or integrity but results in a high impact on availability.
CVE-2026-96405 is a medium severity vulnerability affecting NLnet Labs Unbound versions up to and including 1.26.1. The vulnerability relates to limitations in compression handling, causing an availability impact without compromising confidentiality or integrity. No known exploits are reported in the wild. The affected versions include specific Ubuntu package versions of Unbound. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a moderate risk primarily due to potential denial of service.
A vulnerability exists in NLnet Labs Unbound up to and including version 1.26.1, affecting specific Ubuntu package versions. The flaw has a CVSS 3.1 base score of 6.5, indicating medium severity. It does not impact confidentiality but can cause integrity loss and high availability impact. No public exploits or known active exploitation are reported. The exact technical details of the vulnerability are not provided in the available data.
A low-severity vulnerability identified as CVE-2026-35501 affects NLnet Labs Unbound versions from 1.0.1 up to and including 1.26.1. The vulnerability has a CVSS score of 3.7, indicating low impact, with no confidentiality or availability impact but limited integrity impact. The affected versions include specific Ubuntu package versions of Unbound. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
CVE-2026-70387 is a high-severity vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. It involves an exposed dangerous method in the olc2 logging HAL that allows arbitrary command execution due to insufficient authorization checks. The vulnerability arises because the HAL exposes a binder method that forks and executes a shell command supplied by the caller, with only a check that the caller's UID is 0. SELinux policies grant binder access to this HAL to multiple privileged domains, enabling processes like dumpstate to execute arbitrary commands with full Linux capabilities. Fixed versions are 15.0.0.2000 and 16.0.5.1200.
CVE-2026-70386 is a high-severity OS command injection vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. It allows any locally installed Android app, without declared permissions or user interaction beyond launch, to execute arbitrary shell commands as root in a specific SELinux domain. The flaw arises from an unauthorized binder interface accepting event data that is unsafely passed to a system command, leading to privilege escalation.
OpenStack Cinder through version 29.0.0 contains a vulnerability that allows cross-project information disclosure. This issue has a medium severity with a CVSS score of 4.3, indicating limited confidentiality impact without integrity or availability effects.
OpenStack Manila versions before 23.0.1 contain multiple vulnerabilities in API operations that allow an attacker with low privileges to cause a critical impact on confidentiality, integrity, and availability. The vulnerability has a very high CVSS score of 9.9, indicating severe risk. The affected versions include multiple Ubuntu package releases of Manila. No public exploit or known in-the-wild exploitation is reported. The vulnerability is classified as critical.
CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service, triggered by manipulation of the firewallEn argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed.
Dulwich versions from 0.22.5 up to but not including 1.2.8 contain a path traversal vulnerability. This flaw allows an attacker with local access and user interaction to potentially read, modify, or delete files outside the intended directory. The vulnerability has a high severity rating with a CVSS score of 7.8. Multiple specific package versions, including various Ubuntu builds, are affected.
Dulwich versions before 1.2.9 contain a denial of service vulnerability that can be triggered remotely without privileges. The vulnerability does not impact confidentiality or integrity but can cause service disruption. The CVSS score is 6.5 (medium severity).
FreeRDP versions before 3.32.0 contain a null-pointer dereference vulnerability that can cause a denial of service. The flaw affects multiple Ubuntu package versions of FreeRDP. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with no confidentiality or integrity impact but potential availability impact.
FreeRDP versions before 3.32.1 contain a heap-based buffer overflow vulnerability in the server component. This flaw allows an attacker with local privileges to potentially execute arbitrary code or cause a denial of service. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
FreeRDP versions before 3.32.1 contain a heap out-of-bounds read vulnerability that can lead to information disclosure. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. It affects multiple specific Ubuntu package versions of FreeRDP. No public exploits or known active exploitation have been reported.
FreeRDP version 3.32.0 contains a use-after-free vulnerability in the drdynvc component. This vulnerability can cause a denial of service by crashing the affected system. The issue has a CVSS score of 6.5, indicating a medium severity level. Multiple specific Ubuntu package versions of FreeRDP are affected.
A vulnerability was found in device-mapper-multipath (multipath-tools) affecting specific Ubuntu package versions. The flaw allows a local user to trigger an issue that impacts confidentiality and availability with no privileges required. The CVSS score is 5.1, indicating a medium severity level.
A high-severity vulnerability (CVE-2026-91484) exists in the Java plugin component of Oracle Java SE, specifically affecting OpenJDK 8 versions listed. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality and integrity with no impact on availability. It requires local attack vector, high attack complexity, and low privileges without user interaction. No public exploits or cloud service implications are reported.
CVE-2026-91464 is a medium severity vulnerability affecting specific builds of OpenJDK 8, including versions distributed with Ubuntu 16.04 through 26.10. The flaw impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 5.3, indicating a network attack vector with high complexity, no privileges required, and user interaction needed. The vulnerability allows high confidentiality impact but does not affect integrity or availability.