CVE-2026-31516 is a vulnerability related to the xfrm subsystem where a race condition occurs between policy_hthresh.work and network namespace teardown. The issue affects specific Microsoft product versions 2.0 and 3.0. No CVSS score or detailed technical impact is provided.
CVE-2026-31506 is a vulnerability in Microsoft software identified as a double free issue related to the Wake-on-LAN (WoL) interrupt in the bcmasp network component. The vulnerability affects version 3.0 of the product. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches at this time.
CVE-2026-31462 is a vulnerability related to the drm/amdgpu component involving the prevention of immediate PASID reuse. The provided information is minimal and does not include technical details or impact specifics beyond the title. The affected version is exactly 3.0. No patch or remediation details are provided.
CVE-2026-31493 is a vulnerability in Microsoft software related to RDMA/efa where a completion context is used after it has been freed. This use-after-free flaw can lead to undefined behavior or potential security issues. The affected versions explicitly include 2.0 and 3.0. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches at this time.
CVE-2026-31531 is a vulnerability related to the IPv4 nexthop allocation process in Microsoft software versions 2.0 and 3.0. The issue involves dynamically allocating socket buffers (skb) in the rtm_get_nexthop() function. No detailed technical or impact information is provided, and no CVSS score is assigned.
CVE-2026-31557 is a vulnerability related to the 'nvmet' component involving asynchronous event work handling. The provided information lacks technical details about the nature of the vulnerability or its exploitation. The affected versions are specifically version 2.0 and 3.0 of the Microsoft product referenced. No patch or remediation information is provided, and no known exploits are reported in the wild.
CVE-2026-31663 is a vulnerability identified in Microsoft products, specifically versions 2.0 and 3.0. The vulnerability is titled 'xfrm: hold dev ref until after transport_finish NF_HOOK'. No detailed technical description or impact information is provided beyond the title and affected versions. There is no CVSS score available for this vulnerability.
CVE-2026-31645 is a vulnerability identified in Microsoft software version 3.0 related to a page pool leak in error paths within the net: lan966x component. The provided information does not include technical details beyond the existence of this memory leak issue. No CVSS score or detailed impact description is available.
CVE-2026-31560 is a vulnerability related to the SPI driver component, specifically spi-dw-dma, involving an error in printing logs when waiting for a transaction to finish. The information provided is limited and does not specify the exact nature of the vulnerability or its impact. The affected software versions are Microsoft products version 2.0 and 3.0. No CVSS score is available, and there are no known exploits in the wild. No patch or remediation details are provided in the available data.
CVE-2026-31568 is a vulnerability identified by the Microsoft Security Response Center related to missing secure storage access fixups for donated memory in the s390/mm component. The affected versions are specifically version 2.0 and 3.0 of the product. No CVSS score or detailed technical exploitation information is provided. There are no known exploits in the wild at this time.
CVE-2026-31575 is a vulnerability related to the calculation of the hugetlb fault mutex hash in Microsoft software versions 2.0 and 3.0. The provided information is limited and does not include technical details on exploitation or impact. No CVSS score is available for this vulnerability.
CVE-2026-31630 is a vulnerability identified in Microsoft products version 2.0 and 3.0 related to the rxrpc component's procedure for sizing address buffers for %pISpc output. The available information is limited and does not provide technical details beyond this. No CVSS score or detailed impact analysis is available.
CVE-2026-31489 is a vulnerability identified in Microsoft products version 2.0 and 3.0 related to the spi: meson-spicc component, specifically addressing a double-put issue in the remove path. The provided information is limited and does not include technical details about the nature of the vulnerability or its exploitation. No CVSS score is available, and no known exploits in the wild have been reported.
CVE-2026-31449 is a vulnerability related to the ext4 filesystem code, specifically involving validation of p_idx bounds in the ext4_ext_correct_indexes function. The affected product version is Microsoft 3.0. No CVSS score is provided, and there are no known exploits in the wild. No patch or remediation details are currently available.
This update for python313 fixes the following issues:
Update to version 3.13.13.
- CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to
misinterpretation of tar archives (bsc#1259611).
- CVE-2026-2297: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240).
- CVE-2026-3479: improper resource argument validation in `pkgutil.get_data()` can lead to path traversal (bsc#1259989).
- CVE-2026-3644: incomplete control character validation in http.cookies can lead to input validation bypass
(bsc#1259734).
- CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to C stack overflow (bsc#1259735).
- CVE-2026-4519: failure to sanitize leading dashes in URLs in the `webbrowser.open()` API can lead to web browser
command line option injection (bsc#1260026).
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204)
* kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in the Linux kernel's netfilter nf_tables subsystem involves improper handling of set element insertion when the set is full. This can lead to a race condition where an element is published and removed without waiting for the RCU grace period, potentially causing use-after-free issues. The issue is fixed by adding an element transaction even if the set is full and toggling a flag to safely unwind the set to its previous state. The vulnerability affects version 3.0 of the product.