{"total":26,"page":1,"count":26,"advisories":[{"id":"478dc68d-3b80-4831-859f-c76f88235769","num":214106,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8530-1","title":"USN-8530-1: Linux kernel (AWS) vulnerabilities","summary":"It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - InfiniBand drivers; - SCSI subsystem; - Thermal drivers; - USB over IP driver; - Network file system (NFS) server daemon; - SMB network file system; - Tracing infrastructure; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - DCCP (Datagram Congestion Control Protocol); - IPv4 networking; - IPv6 networking; - Netfilter; - RxRPC session sockets; - X.25 network layer; (CVE-2021-47202, CVE-2024-56643, CVE-2026-23272, CVE-2026-23455, CVE-2026-31402, CVE-2026-31607, CVE-2026-31637, CVE-2026-31659, CVE-2026-31682, CVE-2026-31685, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43383, CVE-2026-43407, CVE-2026-43414, CVE-2026-45988, CVE-2026-46043, CVE-2026-46119, CVE-2026-46243)","link":"https://ubuntu.com/security/notices/USN-8530-1","severity":"unknown","cvss":null,"cves":["CVE-2026-43284","CVE-2026-43503","CVE-2021-47202","CVE-2024-56643","CVE-2026-23272","CVE-2026-23455","CVE-2026-31402","CVE-2026-31607","CVE-2026-31637","CVE-2026-31659","CVE-2026-31682","CVE-2026-31685","CVE-2026-43011","CVE-2026-43037","CVE-2026-43038","CVE-2026-43383","CVE-2026-43407","CVE-2026-43414","CVE-2026-45988","CVE-2026-46043","CVE-2026-46119","CVE-2026-46243"],"exploited":false,"has_exploit":false,"published_at":"2026-07-10T10:07:49+00:00"},{"id":"dafe5285-1ff9-4709-83af-ddd9222e5197","num":214107,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8529-1","title":"USN-8529-1: Linux kernel vulnerabilities","summary":"It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - InfiniBand drivers; - SCSI subsystem; - Thermal drivers; - USB over IP driver; - Network file system (NFS) server daemon; - SMB network file system; - Tracing infrastructure; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - DCCP (Datagram Congestion Control Protocol); - IPv4 networking; - IPv6 networking; - Netfilter; - RxRPC session sockets; - X.25 network layer; (CVE-2021-47202, CVE-2024-56643, CVE-2026-23272, CVE-2026-23455, CVE-2026-31402, CVE-2026-31607, CVE-2026-31637, CVE-2026-31659, CVE-2026-31682, CVE-2026-31685, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43383, CVE-2026-43407, CVE-2026-43414, CVE-2026-45988, CVE-2026-46043, CVE-2026-46119, CVE-2026-46243)","link":"https://ubuntu.com/security/notices/USN-8529-1","severity":"unknown","cvss":null,"cves":["CVE-2026-43503","CVE-2021-47202","CVE-2024-56643","CVE-2026-23272","CVE-2026-23455","CVE-2026-31402","CVE-2026-31607","CVE-2026-31637","CVE-2026-31659","CVE-2026-31682","CVE-2026-31685","CVE-2026-43011","CVE-2026-43037","CVE-2026-43038","CVE-2026-43383","CVE-2026-43407","CVE-2026-43414","CVE-2026-45988","CVE-2026-46043","CVE-2026-46119","CVE-2026-46243"],"exploited":false,"has_exploit":false,"published_at":"2026-07-10T10:00:19+00:00"},{"id":"d9473d5a-13c2-42cd-9e39-e915e99967f5","num":214108,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8528-1","title":"USN-8528-1: Linux kernel (Xilinx ZynqMP) vulnerabilities","summary":"It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431) It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500) It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300) Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - Cryptographic API; - InfiniBand drivers; - IOMMU subsystem; - Ethernet bonding driver; - Network drivers; - STMicroelectronics network drivers; - NVME drivers; - x86 platform drivers; - SCSI subsystem; - SPI subsystem; - TCM subsystem; - USB over IP driver; - File systems infrastructure; - HFS+ file system; - Network file system (NFS) server daemon; - SMB network file system; - IPv6 networking; - Netfilter; - Tracing infrastructure; - io_uring subsystem; - Timer subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - Ceph Core library; - IPv4 networking; - MAC80211 subsystem; - M","link":"https://ubuntu.com/security/notices/USN-8528-1","severity":"unknown","cvss":null,"cves":["CVE-2026-31431","CVE-2026-43284","CVE-2026-43500","CVE-2026-43503","CVE-2026-46300","CVE-2026-46333","CVE-2022-48816","CVE-2023-53673","CVE-2024-35862","CVE-2024-50060","CVE-2025-37778","CVE-2025-37822","CVE-2025-37924","CVE-2025-38201","CVE-2025-40082","CVE-2025-68214","CVE-2025-68263","CVE-2025-71089","CVE-2025-71220","CVE-2025-71222","CVE-2025-71224","CVE-2026-23176","CVE-2026-23180","CVE-2026-23182","CVE-2026-23190","CVE-2026-23193","CVE-2026-23198","CVE-2026-23202","CVE-2026-23206","CVE-2026-23216","CVE-2026-23256","CVE-2026-23257","CVE-2026-23258","CVE-2026-23262","CVE-2026-23272","CVE-2026-23274","CVE-2026-23278","CVE-2026-23351","CVE-2026-23428","CVE-2026-23450","CVE-2026-23455","CVE-2026-31402","CVE-2026-31418","CVE-2026-31419","CVE-2026-31478","CVE-2026-31504","CVE-2026-31533","CVE-2026-31607","CVE-2026-31637","CVE-2026-31649","CVE-2026-31657","CVE-2026-31659","CVE-2026-31668","CVE-2026-31669","CVE-2026-31682","CVE-2026-31685","CVE-2026-43011","CVE-2026-43033","CVE-2026-43037","CVE-2026-43038","CVE-2026-43071","CVE-2026-43077","CVE-2026-43078","CVE-2026-43114","CVE-2026-43117","CVE-2026-43186","CVE-2026-43304","CVE-2026-43341","CVE-2026-43383","CVE-2026-43406","CVE-2026-43407","CVE-2026-43414","CVE-2026-43493","CVE-2026-43494","CVE-2026-43501","CVE-2026-45988","CVE-2026-46028","CVE-2026-46043","CVE-2026-46119","CVE-2026-46135","CVE-2026-46195","CVE-2026-46243"],"exploited":true,"has_exploit":true,"published_at":"2026-07-10T09:52:32+00:00"},{"id":"60a878bd-298f-4f71-ba06-3d3ddb06ca09","num":214109,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8527-1","title":"USN-8527-1: Linux kernel (Raspberry Pi) vulnerabilities","summary":"Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - Cryptographic API; - InfiniBand drivers; - IOMMU subsystem; - Network drivers; - STMicroelectronics network drivers; - NVME drivers; - x86 platform drivers; - SCSI subsystem; - SPI subsystem; - TCM subsystem; - USB over IP driver; - File systems infrastructure; - HFS+ file system; - Network file system (NFS) server daemon; - SMB network file system; - IPv6 networking; - Tracing infrastructure; - Timer subsystem; - B.A.T.M.A.N. meshing protocol; - Bluetooth subsystem; - Ethernet bridge; - Ceph Core library; - IPv4 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - RxRPC session sockets; - SMC sockets; - Sun RPC protocol; - X.25 network layer; - AMD SoC Alsa drivers; - KVM subsystem; (CVE-2022-48816, CVE-2023-53673, CVE-2025-37778, CVE-2025-37822, CVE-2025-37924, CVE-2025-38201, CVE-2025-40082, CVE-2025-68214, CVE-2025-68263, CVE-2025-71089, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2026-23176, CVE-2026-23180, CVE-2026-23182, CVE-2026-23190, CVE-2026-23193, CVE-2026-23198, CVE-2026-23202, CVE-2026-23206, CVE-2026-23216, CVE-2026-23256, CVE-2026-23257, CVE-2026-23258, CVE-2026-23262, CVE-2026-23272, CVE-2026-23278, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31478, CVE-2026-31607, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43114, CVE-2026-43117, CVE-2026-43186, CVE-2026-43304, CVE-2026-43341, CVE-2026-43383, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45988, CVE-2026-46043, CVE-2026-46119, CVE-2026-46135, CVE-2026-46195, CVE-2026-46243)","link":"https://ubuntu.com/security/notices/USN-8527-1","severity":"unknown","cvss":null,"cves":["CVE-2022-48816","CVE-2023-53673","CVE-2025-37778","CVE-2025-37822","CVE-2025-37924","CVE-2025-38201","CVE-2025-40082","CVE-2025-68214","CVE-2025-68263","CVE-2025-71089","CVE-2025-71220","CVE-2025-71222","CVE-2025-71224","CVE-2026-23176","CVE-2026-23180","CVE-2026-23182","CVE-2026-23190","CVE-2026-23193","CVE-2026-23198","CVE-2026-23202","CVE-2026-23206","CVE-2026-23216","CVE-2026-23256","CVE-2026-23257","CVE-2026-23258","CVE-2026-23262","CVE-2026-23272","CVE-2026-23278","CVE-2026-23428","CVE-2026-23450","CVE-2026-23455","CVE-2026-31402","CVE-2026-31418","CVE-2026-31478","CVE-2026-31607","CVE-2026-31637","CVE-2026-31649","CVE-2026-31657","CVE-2026-31659","CVE-2026-31668","CVE-2026-31669","CVE-2026-31682","CVE-2026-31685","CVE-2026-43011","CVE-2026-43037","CVE-2026-43038","CVE-2026-43071","CVE-2026-43114","CVE-2026-43117","CVE-2026-43186","CVE-2026-43304","CVE-2026-43341","CVE-2026-43383","CVE-2026-43406","CVE-2026-43407","CVE-2026-43414","CVE-2026-43493","CVE-2026-43501","CVE-2026-45988","CVE-2026-46043","CVE-2026-46119","CVE-2026-46135","CVE-2026-46195","CVE-2026-46243"],"exploited":false,"has_exploit":false,"published_at":"2026-07-10T09:45:14+00:00"},{"id":"10c30784-bd63-4c2c-bb44-7569e4395e49","num":209626,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8492-5","title":"USN-8492-5: Linux kernel (FIPS) vulnerabilities","summary":"Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - RNBD block device driver; - Ublk userspace block driver; - Bus devices; - Character device driver; - TPM device driver; - Clock framework and drivers; - Clocksource drivers; - CPU idle management framework; - Hardware crypto device drivers; - DMA engine subsystem; - EFI core; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - IIO subsystem; - InfiniBand drivers; - IOMMU subsystem; - Multiple devices driver; - Media drivers; - Multifunction device drivers; - Broadcom VK accelerator driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - NTB driver; - NVME drivers; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - Power supply drivers; - RapidIO drivers; - RAS (Reliability, Availability, Serviceability) subsystem; - Remote Processor subsystem; - RPMSG subsystem; - S/390 drivers; - SCSI subsystem; - MediaTek SoC drivers; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Realtek RTL8723BS SDIO drivers; - UFS subsystem; - ChipIdea USB driver; - DesignWare USB3 driver; - USB over IP driver; - vDPA drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - BTRFS file system; - File systems infrastructure; - Ceph distributed file system; - Ext4 file system; - F2FS file system; - FAT file system; - GFS2 file system; - HFS+ file system; - JFS file system; - Network file system (NFS) server daemon; - NILFS2 file system; - NTFS3 file system; - OCFS2 file system; - Proc fi","link":"https://ubuntu.com/security/notices/USN-8492-5","severity":"unknown","cvss":null,"cves":["CVE-2025-40005","CVE-2025-71229","CVE-2025-71231","CVE-2025-71232","CVE-2025-71233","CVE-2025-71235","CVE-2025-71236","CVE-2025-71237","CVE-2025-71238","CVE-2025-71239","CVE-2025-71265","CVE-2025-71266","CVE-2025-71267","CVE-2025-71272","CVE-2025-71273","CVE-2025-71274","CVE-2025-71286","CVE-2025-71291","CVE-2025-71292","CVE-2025-71294","CVE-2025-71295","CVE-2025-71297","CVE-2025-71304","CVE-2025-71305","CVE-2026-23100","CVE-2026-23169","CVE-2026-23220","CVE-2026-23221","CVE-2026-23222","CVE-2026-23228","CVE-2026-23229","CVE-2026-23230","CVE-2026-23233","CVE-2026-23234","CVE-2026-23235","CVE-2026-23236","CVE-2026-23237","CVE-2026-23238","CVE-2026-23241","CVE-2026-23242","CVE-2026-23243","CVE-2026-23249","CVE-2026-23266","CVE-2026-23267","CVE-2026-23272","CVE-2026-23278","CVE-2026-23392","CVE-2026-23428","CVE-2026-23450","CVE-2026-23455","CVE-2026-31402","CVE-2026-31411","CVE-2026-31418","CVE-2026-31436","CVE-2026-31448","CVE-2026-31478","CVE-2026-31607","CVE-2026-31637","CVE-2026-31649","CVE-2026-31657","CVE-2026-31659","CVE-2026-31668","CVE-2026-31669","CVE-2026-31682","CVE-2026-31685","CVE-2026-31687","CVE-2026-31693","CVE-2026-43011","CVE-2026-43037","CVE-2026-43038","CVE-2026-43071","CVE-2026-43114","CVE-2026-43117","CVE-2026-43123","CVE-2026-43124","CVE-2026-43128","CVE-2026-43130","CVE-2026-43132","CVE-2026-43133","CVE-2026-43134","CVE-2026-43135","CVE-2026-43136","CVE-2026-43137","CVE-2026-43139","CVE-2026-43140","CVE-2026-43141","CVE-2026-43143","CVE-2026-43145","CVE-2026-43147","CVE-2026-43148","CVE-2026-43149","CVE-2026-43150","CVE-2026-43152","CVE-2026-43153","CVE-2026-43156","CVE-2026-43157","CVE-2026-43158","CVE-2026-43159","CVE-2026-43163","CVE-2026-43167","CVE-2026-43168","CVE-2026-43169","CVE-2026-43170","CVE-2026-43171","CVE-2026-43173","CVE-2026-43175","CVE-2026-43180","CVE-2026-43182","CVE-2026-43183","CVE-2026-43184","CVE-2026-43186","CVE-2026-43187","CVE-2026-43189","CVE-2026-43190","CVE-2026-43194","CVE-2026-43196","CVE-2026-43199","CVE-2026-43200","CVE-2026-43201","CVE-2026-43202","CVE-2026-43203","CVE-2026-43205","CVE-2026-43206","CVE-2026-43207","CVE-2026-43209","CVE-2026-43211","CVE-2026-43212","CVE-2026-43214","CVE-2026-43215","CVE-2026-43218","CVE-2026-43221","CVE-2026-43222","CVE-2026-43223","CVE-2026-43225","CVE-2026-43226","CVE-2026-43227","CVE-2026-43230","CVE-2026-43231","CVE-2026-43232","CVE-2026-43233","CVE-2026-43236","CVE-2026-43238","CVE-2026-43239","CVE-2026-43241","CVE-2026-43242","CVE-2026-43244","CVE-2026-43246","CVE-2026-43248","CVE-2026-43249","CVE-2026-43250","CVE-2026-43251","CVE-2026-43253","CVE-2026-43255","CVE-2026-43256","CVE-2026-43257","CVE-2026-43258","CVE-2026-43261","CVE-2026-43262","CVE-2026-43264","CVE-2026-43266","CVE-2026-43268","CVE-2026-43269","CVE-2026-43270","CVE-2026-43271","CVE-2026-43273","CVE-2026-43275","CVE-2026-43277","CVE-2026-43278","CVE-2026-43279","CVE-2026-43283","CVE-2026-43287","CVE-2026-43288","CVE-2026-43289","CVE-2026-43291","CVE-2026-43295","CVE-2026-43296","CVE-2026-43297","CVE-2026-43300","CVE-2026-43302","CVE-2026-43304","CVE-2026-43312","CVE-2026-43313","CVE-2026-43314","CVE-2026-43315","CVE-2026-43316","CVE-2026-43317","CVE-2026-43318","CVE-2026-43319","CVE-2026-43320","CVE-2026-43341","CVE-2026-43378","CVE-2026-43383","CVE-2026-43384","CVE-2026-43406","CVE-2026-43407","CVE-2026-43414","CVE-2026-43493","CVE-2026-43501","CVE-2026-45847","CVE-2026-45848","CVE-2026-45849","CVE-2026-45851","CVE-2026-45852","CVE-2026-45856","CVE-2026-45857","CVE-2026-45859","CVE-2026-45860","CVE-2026-45861","CVE-2026-45862","CVE-2026-45864","CVE-2026-45865","CVE-2026-45866","CVE-2026-45867","CVE-2026-45868","CVE-2026-45869","CVE-2026-45870","CVE-2026-45871","CVE-2026-45872","CVE-2026-45873","CVE-2026-45875","CVE-2026-45877","CVE-2026-45878","CVE-2026-45879","CVE-2026-45880","CVE-2026-45881","CVE-2026-45882","CVE-2026-45883","CVE-2026-45884","CVE-2026-45885","CVE-2026-45886","CVE-2026-45890","CVE-2026-45891","CVE-2026-45893","CVE-2026-45895","CVE-2026-45902","CVE-2026-45904","CVE-2026-45905","CVE-2026-45910","CVE-2026-45912","CVE-2026-45913","CVE-2026-45914","CVE-2026-45915","CVE-2026-45916","CVE-2026-45917","CVE-2026-45919","CVE-2026-45921","CVE-2026-45923","CVE-2026-45928","CVE-2026-45935","CVE-2026-45936","CVE-2026-45938","CVE-2026-45941","CVE-2026-45946","CVE-2026-45947","CVE-2026-45948","CVE-2026-45954","CVE-2026-45957","CVE-2026-45960","CVE-2026-45962","CVE-2026-45964","CVE-2026-45965","CVE-2026-45968","CVE-2026-45969","CVE-2026-45970","CVE-2026-45972","CVE-2026-45973","CVE-2026-45974","CVE-2026-45976","CVE-2026-45978","CVE-2026-45981","CVE-2026-45982","CVE-2026-45983","CVE-2026-45984","CVE-2026-45988","CVE-2026-46043","CVE-2026-46115","CVE-2026-46119","CVE-2026-46135","CVE-2026-46185","CVE-2026-46195","CVE-2026-46243","CVE-2026-46244","CVE-2026-46246","CVE-2026-46247","CVE-2026-46249","CVE-2026-46250","CVE-2026-46251","CVE-2026-46253","CVE-2026-46254","CVE-2026-46255","CVE-2026-46259","CVE-2026-46260","CVE-2026-46261","CVE-2026-46265","CVE-2026-46266","CVE-2026-46267","CVE-2026-46270","CVE-2026-46289","CVE-2026-46328"],"exploited":false,"has_exploit":false,"published_at":"2026-07-10T09:38:58+00:00"},{"id":"58d02fb0-7e5e-458a-85b9-f7ceda82a132","num":200736,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8526-1","title":"USN-8526-1: libheif vulnerabilities","summary":"Xianrui Dong discovered that libheif had an out-of-bounds read in its HEIF sequence track parser. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-47254) Junyi Liu discovered that libheif had a null pointer dereference in its image tiling interface. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-47709) Calvin Young and Enoch Chow discovered that libheif had an integer overflow in its inline mask size calculation. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-47714) Ariel Koren discovered that libheif had an integer underflow in its grid image tile coordinate transform. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-48029) It was discovered that libheif had a missing bound check in its HEIF sequence parser, allowing unbounded heap allocation. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-50142)","link":"https://ubuntu.com/security/notices/USN-8526-1","severity":"unknown","cvss":null,"cves":["CVE-2026-47254","CVE-2026-47709","CVE-2026-47714","CVE-2026-48029","CVE-2026-50142"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T19:25:53+00:00"},{"id":"ef528b95-7272-48d5-9349-e87323275ae8","num":200737,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8525-1","title":"USN-8525-1: curl vulnerabilities","summary":"Harry Sintonen discovered that curl incorrectly handled credentials when following HTTP redirects in conjunction with .netrc files. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-11053) Hiroki Kurosawa discovered that curl incorrectly handled OCSP stapling responses. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-8096) Joshua Rogers discovered that curl had a use-after-free vulnerability when resetting and cleaning up HTTP/2 stream handles. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2026-10536) Quac Tran and Ngoc Hieu discovered that curl incorrectly reused connections when switching authentication methods to the same host. An attacker could possibly use this issue to obtain sensitive information or perform unauthorized actions. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-5545) Osama Hamad discovered that curl incorrectly reused SMB connections when the target share differed between transfers. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-5773) Muhamad Arga Reksapati discovered that curl incorrectly forwarded Digest proxy authentication credentials to a different proxy host. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-7168) It was discovered that curl incorrectly skipped SSH host verification options when using schemeless URLs with --proto-default. An attacker could possibly use this issue to perform machine-in-the-middle attacks. This issue only affected Ubuntu 25.04 and Ubunt","link":"https://ubuntu.com/security/notices/USN-8525-1","severity":"unknown","cvss":null,"cves":["CVE-2024-11053","CVE-2024-8096","CVE-2026-10536","CVE-2026-5545","CVE-2026-5773","CVE-2026-7168","CVE-2026-12064","CVE-2026-11586","CVE-2026-11352","CVE-2026-11564"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T19:14:44+00:00"},{"id":"66dab8fd-b6e6-43a0-8c90-2a0f4503662c","num":196318,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8524-1","title":"USN-8524-1: Python vulnerability","summary":"It was discovered that Python did not use sufficient entropy for Expat hash-flooding protection in the xml.parsers.expat and xml.etree.ElementTree modules. An attacker could use this to cause a denial of service via a crafted XML document.","link":"https://ubuntu.com/security/notices/USN-8524-1","severity":"unknown","cvss":null,"cves":["CVE-2026-7210"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T15:11:48+00:00"},{"id":"ace7ad64-50cc-45de-be1c-271011eb6248","num":196319,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8523-1","title":"USN-8523-1: libsoup vulnerabilities","summary":"Eric Su and Samuel Dainard discovered that libsoup incorrectly handled content with zero-length resources. An attacker could possibly use this issue to trigger a buffer over-read, resulting in information disclosure or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2369) Kona Arctic discovered that libsoup did not properly protect sensitive cookies when establishing HTTPS tunnels through an HTTP proxy. An attacker could possibly use this issue to intercept session cookies, resulting in session hijacking or user impersonation. (CVE-2026-5119)","link":"https://ubuntu.com/security/notices/USN-8523-1","severity":"unknown","cvss":null,"cves":["CVE-2026-2369","CVE-2026-5119"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T14:13:33+00:00"},{"id":"d05adde5-fae3-4b61-b899-779dba33cb6d","num":187640,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8522-1","title":"USN-8522-1: LibRaw vulnerabilities","summary":"It was discovered that LibRaw incorrectly handled certain Nikon RAW image files. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service. (CVE-2026-5342) It was discovered that LibRaw had an integer overflow in its DNG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-20884) It was discovered that LibRaw incorrectly handled certain X3F thumbnail data. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-20889) It was discovered that LibRaw had a heap-based buffer overflow in its lossless JPEG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-21413) It was discovered that LibRaw had an integer overflow in its uncompressed floating-point DNG image loader. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2026-24450) It was discovered that LibRaw had a heap-based buffer overflow in its X3F Huffman decoder. An attacker could possibly use this issue to cause LibRaw to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-24660)","link":"https://ubuntu.com/security/notices/USN-8522-1","severity":"unknown","cvss":null,"cves":["CVE-2026-5342","CVE-2026-20884","CVE-2026-20889","CVE-2026-21413","CVE-2026-24450","CVE-2026-24660"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T12:45:50+00:00"},{"id":"734f58ba-1172-4558-939e-9d65cb272915","num":187641,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8521-1","title":"USN-8521-1: Libidn vulnerability","summary":"It was discovered that Libidn incorrectly handled certain internationalized domain name strings. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service.","link":"https://ubuntu.com/security/notices/USN-8521-1","severity":"unknown","cvss":null,"cves":["CVE-2026-57053"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T12:36:22+00:00"},{"id":"84ea0ab8-b025-4ca3-81d2-91fe7d61b1a8","num":187642,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8520-1","title":"USN-8520-1: Expat vulnerability","summary":"It was discovered that Expat used insufficient entropy when generating hash salt values for its internal hash table. An attacker could use this to craft an XML document that triggers hash flooding, leading to a denial of service.","link":"https://ubuntu.com/security/notices/USN-8520-1","severity":"unknown","cvss":null,"cves":["CVE-2026-41080"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T11:51:02+00:00"},{"id":"e6b1c21a-0865-4e95-aca6-e950e15e2d09","num":187643,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8519-1","title":"USN-8519-1: Go Cryptography vulnerabilities","summary":"Jakub Ciolek and Nicola Murino discovered that Go Cryptography incorrectly handled SSH agent responses. An attacker could use this to cause a denial of service. (CVE-2025-47913) Yuichi Watanabe discovered that Go Cryptography incorrectly handled SSH key exchanges. An attacker could use this to cause a denial of service. This issue did not affect Ubuntu 16.04 LTS. (CVE-2025-22869)","link":"https://ubuntu.com/security/notices/USN-8519-1","severity":"unknown","cvss":null,"cves":["CVE-2025-47913","CVE-2025-22869"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T08:41:10+00:00"},{"id":"ab0b0c75-c477-4abc-86c1-365c55979e69","num":183197,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8492-4","title":"USN-8492-4: Linux kernel (Raspberry Pi) vulnerabilities","summary":"Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - ATM drivers; - RNBD block device driver; - Ublk userspace block driver; - Bus devices; - Character device driver; - TPM device driver; - Clock framework and drivers; - Clocksource drivers; - CPU idle management framework; - Hardware crypto device drivers; - DMA engine subsystem; - EFI core; - GPIO subsystem; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - IIO subsystem; - InfiniBand drivers; - IOMMU subsystem; - Multiple devices driver; - Media drivers; - Multifunction device drivers; - Broadcom VK accelerator driver; - MOST (Media Oriented Systems Transport) drivers; - MTD block device drivers; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - NTB driver; - NVME drivers; - PCI subsystem; - Performance monitor drivers; - Pin controllers subsystem; - x86 platform drivers; - Power supply drivers; - RapidIO drivers; - RAS (Reliability, Availability, Serviceability) subsystem; - Remote Processor subsystem; - RPMSG subsystem; - S/390 drivers; - SCSI subsystem; - MediaTek SoC drivers; - Texas Instruments SoC drivers; - SPI subsystem; - Greybus lights staging drivers; - Realtek RTL8723BS SDIO drivers; - UFS subsystem; - ChipIdea USB driver; - DesignWare USB3 driver; - USB over IP driver; - vDPA drivers; - Virtio Host (VHOST) subsystem; - Framebuffer layer; - BTRFS file system; - File systems infrastructure; - Ceph distributed file system; - Ext4 file system; - F2FS file system; - FAT file system; - GFS2 file system; - HFS+ file system; - JFS file system; - Network file system (NFS) server daemon; - NILFS2 file system; - NTFS3 file system; - OCFS2 file system; - Proc fi","link":"https://ubuntu.com/security/notices/USN-8492-4","severity":"unknown","cvss":null,"cves":["CVE-2025-40005","CVE-2025-71229","CVE-2025-71231","CVE-2025-71232","CVE-2025-71233","CVE-2025-71235","CVE-2025-71236","CVE-2025-71237","CVE-2025-71238","CVE-2025-71239","CVE-2025-71265","CVE-2025-71266","CVE-2025-71267","CVE-2025-71272","CVE-2025-71273","CVE-2025-71274","CVE-2025-71286","CVE-2025-71291","CVE-2025-71292","CVE-2025-71294","CVE-2025-71295","CVE-2025-71297","CVE-2025-71304","CVE-2025-71305","CVE-2026-23100","CVE-2026-23169","CVE-2026-23220","CVE-2026-23221","CVE-2026-23222","CVE-2026-23228","CVE-2026-23229","CVE-2026-23230","CVE-2026-23233","CVE-2026-23234","CVE-2026-23235","CVE-2026-23236","CVE-2026-23237","CVE-2026-23238","CVE-2026-23241","CVE-2026-23242","CVE-2026-23243","CVE-2026-23249","CVE-2026-23266","CVE-2026-23267","CVE-2026-23272","CVE-2026-23278","CVE-2026-23392","CVE-2026-23428","CVE-2026-23450","CVE-2026-23455","CVE-2026-31402","CVE-2026-31411","CVE-2026-31418","CVE-2026-31436","CVE-2026-31448","CVE-2026-31478","CVE-2026-31607","CVE-2026-31637","CVE-2026-31649","CVE-2026-31657","CVE-2026-31659","CVE-2026-31668","CVE-2026-31669","CVE-2026-31682","CVE-2026-31685","CVE-2026-31687","CVE-2026-31693","CVE-2026-43011","CVE-2026-43037","CVE-2026-43038","CVE-2026-43071","CVE-2026-43114","CVE-2026-43117","CVE-2026-43123","CVE-2026-43124","CVE-2026-43128","CVE-2026-43130","CVE-2026-43132","CVE-2026-43133","CVE-2026-43134","CVE-2026-43135","CVE-2026-43136","CVE-2026-43137","CVE-2026-43139","CVE-2026-43140","CVE-2026-43141","CVE-2026-43143","CVE-2026-43145","CVE-2026-43147","CVE-2026-43148","CVE-2026-43149","CVE-2026-43150","CVE-2026-43152","CVE-2026-43153","CVE-2026-43156","CVE-2026-43157","CVE-2026-43158","CVE-2026-43159","CVE-2026-43163","CVE-2026-43167","CVE-2026-43168","CVE-2026-43169","CVE-2026-43170","CVE-2026-43171","CVE-2026-43173","CVE-2026-43175","CVE-2026-43180","CVE-2026-43182","CVE-2026-43183","CVE-2026-43184","CVE-2026-43186","CVE-2026-43187","CVE-2026-43189","CVE-2026-43190","CVE-2026-43194","CVE-2026-43196","CVE-2026-43199","CVE-2026-43200","CVE-2026-43201","CVE-2026-43202","CVE-2026-43203","CVE-2026-43205","CVE-2026-43206","CVE-2026-43207","CVE-2026-43209","CVE-2026-43211","CVE-2026-43212","CVE-2026-43214","CVE-2026-43215","CVE-2026-43218","CVE-2026-43221","CVE-2026-43222","CVE-2026-43223","CVE-2026-43225","CVE-2026-43226","CVE-2026-43227","CVE-2026-43230","CVE-2026-43231","CVE-2026-43232","CVE-2026-43233","CVE-2026-43236","CVE-2026-43238","CVE-2026-43239","CVE-2026-43241","CVE-2026-43242","CVE-2026-43244","CVE-2026-43246","CVE-2026-43248","CVE-2026-43249","CVE-2026-43250","CVE-2026-43251","CVE-2026-43253","CVE-2026-43255","CVE-2026-43256","CVE-2026-43257","CVE-2026-43258","CVE-2026-43261","CVE-2026-43262","CVE-2026-43264","CVE-2026-43266","CVE-2026-43268","CVE-2026-43269","CVE-2026-43270","CVE-2026-43271","CVE-2026-43273","CVE-2026-43275","CVE-2026-43277","CVE-2026-43278","CVE-2026-43279","CVE-2026-43283","CVE-2026-43287","CVE-2026-43288","CVE-2026-43289","CVE-2026-43291","CVE-2026-43295","CVE-2026-43296","CVE-2026-43297","CVE-2026-43300","CVE-2026-43302","CVE-2026-43304","CVE-2026-43312","CVE-2026-43313","CVE-2026-43314","CVE-2026-43315","CVE-2026-43316","CVE-2026-43317","CVE-2026-43318","CVE-2026-43319","CVE-2026-43320","CVE-2026-43341","CVE-2026-43378","CVE-2026-43383","CVE-2026-43384","CVE-2026-43406","CVE-2026-43407","CVE-2026-43414","CVE-2026-43493","CVE-2026-43501","CVE-2026-45847","CVE-2026-45848","CVE-2026-45849","CVE-2026-45851","CVE-2026-45852","CVE-2026-45856","CVE-2026-45857","CVE-2026-45859","CVE-2026-45860","CVE-2026-45861","CVE-2026-45862","CVE-2026-45864","CVE-2026-45865","CVE-2026-45866","CVE-2026-45867","CVE-2026-45868","CVE-2026-45869","CVE-2026-45870","CVE-2026-45871","CVE-2026-45872","CVE-2026-45873","CVE-2026-45875","CVE-2026-45877","CVE-2026-45878","CVE-2026-45879","CVE-2026-45880","CVE-2026-45881","CVE-2026-45882","CVE-2026-45883","CVE-2026-45884","CVE-2026-45885","CVE-2026-45886","CVE-2026-45890","CVE-2026-45891","CVE-2026-45893","CVE-2026-45895","CVE-2026-45902","CVE-2026-45904","CVE-2026-45905","CVE-2026-45910","CVE-2026-45912","CVE-2026-45913","CVE-2026-45914","CVE-2026-45915","CVE-2026-45916","CVE-2026-45917","CVE-2026-45919","CVE-2026-45921","CVE-2026-45923","CVE-2026-45928","CVE-2026-45935","CVE-2026-45936","CVE-2026-45938","CVE-2026-45941","CVE-2026-45946","CVE-2026-45947","CVE-2026-45948","CVE-2026-45954","CVE-2026-45957","CVE-2026-45960","CVE-2026-45962","CVE-2026-45964","CVE-2026-45965","CVE-2026-45968","CVE-2026-45969","CVE-2026-45970","CVE-2026-45972","CVE-2026-45973","CVE-2026-45974","CVE-2026-45976","CVE-2026-45978","CVE-2026-45981","CVE-2026-45982","CVE-2026-45983","CVE-2026-45984","CVE-2026-45988","CVE-2026-46043","CVE-2026-46115","CVE-2026-46119","CVE-2026-46135","CVE-2026-46185","CVE-2026-46195","CVE-2026-46243","CVE-2026-46244","CVE-2026-46246","CVE-2026-46247","CVE-2026-46249","CVE-2026-46250","CVE-2026-46251","CVE-2026-46253","CVE-2026-46254","CVE-2026-46255","CVE-2026-46259","CVE-2026-46260","CVE-2026-46261","CVE-2026-46265","CVE-2026-46266","CVE-2026-46267","CVE-2026-46270","CVE-2026-46289","CVE-2026-46328"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T08:10:03+00:00"},{"id":"4f0dab99-5013-4d75-a4ad-b46c47527b52","num":183198,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8490-2","title":"USN-8490-2: Linux kernel (Raspberry Pi) vulnerabilities","summary":"Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; - STMicroelectronics network drivers; - Network drivers; - NVME drivers; - SCSI subsystem; - USB over IP driver; - File systems infrastructure; - Ext4 file system; - Network file system (NFS) server daemon; - SMB network file system; - Kernel thread helper (kthread); - IPv6 networking; - Tracing infrastructure; - Kernel exit() syscall; - Scatterlist API; - B.A.T.M.A.N. meshing protocol; - Ethernet bridge; - Ceph Core library; - IPv4 networking; - Multipath TCP; - Netfilter; - RxRPC session sockets; - SMC sockets; - X.25 network layer; (CVE-2026-22984, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682, CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083, CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45988, CVE-2026-46039, CVE-2026-46043, CVE-2026-46115, CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289, CVE-2026-46316, CVE-2026-46325)","link":"https://ubuntu.com/security/notices/USN-8490-2","severity":"unknown","cvss":null,"cves":["CVE-2026-22984","CVE-2026-23272","CVE-2026-23278","CVE-2026-23392","CVE-2026-23427","CVE-2026-23428","CVE-2026-23450","CVE-2026-23455","CVE-2026-31402","CVE-2026-31418","CVE-2026-31436","CVE-2026-31448","CVE-2026-31478","CVE-2026-31607","CVE-2026-31635","CVE-2026-31637","CVE-2026-31649","CVE-2026-31657","CVE-2026-31659","CVE-2026-31668","CVE-2026-31669","CVE-2026-31682","CVE-2026-31685","CVE-2026-31718","CVE-2026-43011","CVE-2026-43037","CVE-2026-43038","CVE-2026-43071","CVE-2026-43083","CVE-2026-43114","CVE-2026-43117","CVE-2026-43125","CVE-2026-43186","CVE-2026-43197","CVE-2026-43304","CVE-2026-43341","CVE-2026-43376","CVE-2026-43378","CVE-2026-43383","CVE-2026-43384","CVE-2026-43402","CVE-2026-43406","CVE-2026-43407","CVE-2026-43414","CVE-2026-43493","CVE-2026-43501","CVE-2026-45898","CVE-2026-45988","CVE-2026-46039","CVE-2026-46043","CVE-2026-46115","CVE-2026-46119","CVE-2026-46135","CVE-2026-46185","CVE-2026-46195","CVE-2026-46243","CVE-2026-46244","CVE-2026-46266","CVE-2026-46289","CVE-2026-46316","CVE-2026-46325"],"exploited":false,"has_exploit":false,"published_at":"2026-07-09T07:55:55+00:00"},{"id":"f00f59cc-7d72-4c9e-b5fc-65f96bad25a2","num":174395,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8518-1","title":"USN-8518-1: mailcap vulnerability","summary":"Aaron Rainbolt discovered that the cautious-launcher utility in the mailcap package did not properly restrict the execution of certain file types. An attacker could use this issue to escape a sandboxed application and execute arbitrary code on the host operating system.","link":"https://ubuntu.com/security/notices/USN-8518-1","severity":"unknown","cvss":null,"cves":["CVE-2026-10037"],"exploited":false,"has_exploit":false,"published_at":"2026-07-08T17:15:41+00:00"},{"id":"70646182-185d-4d26-ad3d-fc2f4fb293be","num":170027,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8517-1","title":"USN-8517-1: ClamAV vulnerabilities","summary":"It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20213, CVE-2026-20214, CVE-2026-20217) It was discovered that ClamAV incorrectly handled certain 7z archive files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20215) It was discovered that ClamAV incorrectly handled extraction limits for certain InstallShield archives. A remote attacker could possibly use this issue to cause ClamAV to use excessive resources, leading to a denial of service. (CVE-2026-20216) It was discovered that ClamAV incorrectly handled certain ALZ archive files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20243) It was discovered that ClamAV incorrectly handled certain DMG files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20244)","link":"https://ubuntu.com/security/notices/USN-8517-1","severity":"unknown","cvss":null,"cves":["CVE-2026-20213","CVE-2026-20214","CVE-2026-20217","CVE-2026-20215","CVE-2026-20216","CVE-2026-20243","CVE-2026-20244"],"exploited":false,"has_exploit":false,"published_at":"2026-07-08T14:07:06+00:00"},{"id":"4d61e77f-8c11-45bd-ba06-ec21de7fe3d1","num":170028,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8516-1","title":"USN-8516-1: Apache HTTP Server vulnerabilities","summary":"It was discovered that Apache HTTP Server's mod_ldap module incorrectly handled memory when processing per-directory configurations. An attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-29167) It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled HTML generation for FTP directory listings. A remote attacker could possibly use this issue to inject arbitrary web script or HTML. (CVE-2026-29170) It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34355) It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-34356) It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535) It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42536) It was discovered that Apache HTTP Server incorrectly handled response headers when multiple content languages were configured. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43951) It was discovered that Apache HTTP Server incorrectly restricted certain file functions in expressions within .htaccess files. A local attacker with .htaccess write access could possibly use this issue to obt","link":"https://ubuntu.com/security/notices/USN-8516-1","severity":"unknown","cvss":null,"cves":["CVE-2026-29167","CVE-2026-29170","CVE-2026-34355","CVE-2026-34356","CVE-2026-42535","CVE-2026-42536","CVE-2026-43951","CVE-2026-44119","CVE-2026-44185","CVE-2026-44186","CVE-2026-44631","CVE-2026-48913"],"exploited":false,"has_exploit":false,"published_at":"2026-07-08T13:49:49+00:00"},{"id":"36d3b1f4-912a-481d-a905-7d66a93d6282","num":170029,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8515-1","title":"USN-8515-1: Addressable vulnerability","summary":"It was discovered that Addressable incorrectly handled certain URI templates, generating regular expressions vulnerable to catastrophic backtracking. An attacker could use this issue to craft a URI that, when matched against a vulnerable template, causes excessive resource consumption, leading to a denial of service.","link":"https://ubuntu.com/security/notices/USN-8515-1","severity":"unknown","cvss":null,"cves":["CVE-2026-35611"],"exploited":false,"has_exploit":false,"published_at":"2026-07-07T10:46:24+00:00"},{"id":"1fb59dc7-9a66-4bb1-9ffe-f85256a1dfc8","num":170030,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8514-1","title":"USN-8514-1: OpenSSH vulnerability","summary":"It was discovered that OpenSSH incorrectly handled file permissions when downloading files as root using the legacy scp protocol without the preserve-mode option. An attacker could use this to install setuid or setgid files on a system, possibly leading to privilege escalation.","link":"https://ubuntu.com/security/notices/USN-8514-1","severity":"unknown","cvss":null,"cves":["CVE-2026-35385"],"exploited":false,"has_exploit":false,"published_at":"2026-07-06T14:32:58+00:00"},{"id":"8ac0a07c-6417-46e0-9803-bee55a8860da","num":170031,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8502-1","title":"USN-8502-1: GnuTLS vulnerabilities","summary":"It was discovered that GnuTLS had a timing side-channel when processing malformed ciphertexts in RSA-PSK ClientKeyExchange. A remote attacker could possibly use this issue to recover sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-0553) Bing Shi discovered that GnuTLS incorrectly handled decoding certain DER-encoded certificates. A remote attacker could possibly use this issue to cause GnuTLS to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-12243) Luigino Camastra discovered that GnuTLS incorrectly handled certain PKCS11 token labels. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2025-9820) Tim Scheckenbach discovered that GnuTLS incorrectly handled malicious certificates containing a large number of name constraints and subject alternative names. A remote attacker could possibly use this issue to cause GnuTLS to consume resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-14831) Oleh Konko and Joshua Rogers discovered that GnuTLS did not properly handle case-insensitive name constraints in certain cases. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. (CVE-2026-3833) Joshua Rogers discovered that GnuTLS did not properly handle very short premaster secrets in certain RSA key exchange cases with PKCS#11-backed server keys. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-5260) Joshua Rogers discovered that GnuTLS did not properly handle malformed DTLS handshake fragments in certain cases. A remote attacker could possibly use this issue to ob","link":"https://ubuntu.com/security/notices/USN-8502-1","severity":"unknown","cvss":null,"cves":["CVE-2024-0553","CVE-2024-12243","CVE-2025-9820","CVE-2025-14831","CVE-2026-3833","CVE-2026-5260","CVE-2026-33845","CVE-2026-33846","CVE-2026-42009","CVE-2026-42010"],"exploited":false,"has_exploit":false,"published_at":"2026-07-06T13:37:09+00:00"},{"id":"123a5ffd-f49c-495d-8ea7-c64491ee6459","num":170032,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8513-1","title":"USN-8513-1: PHP vulnerabilities","summary":"It was discovered that PHP incorrectly handled SOAP object deduplication when processing apache:Map nodes with duplicate keys. An attacker could possibly use this to cause a use-after-free, resulting in remote code execution. (CVE-2026-6722) It was discovered that PHP incorrectly handled SOAP request persistence when configured with SOAP_PERSISTENCE_SESSION. An attacker could possibly use this to cause a use-after-free, resulting in memory corruption, information disclosure, or a denial of service. (CVE-2026-7261) It was discovered that the PDO Firebird driver in PHP improperly handled NUL bytes when quoting SQL query strings. An attacker could possibly use this to perform SQL injection when attacker-controlled values are embedded in SQL statements. (CVE-2025-14179)","link":"https://ubuntu.com/security/notices/USN-8513-1","severity":"unknown","cvss":null,"cves":["CVE-2026-6722","CVE-2026-7261","CVE-2025-14179"],"exploited":false,"has_exploit":false,"published_at":"2026-07-06T13:22:54+00:00"},{"id":"23dd8e77-d7c5-4f01-8da4-64006ffa0010","num":170033,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8512-1","title":"USN-8512-1: Gzip vulnerabilities","summary":"It was discovered that Gzip's gzexe utility handled temporary files in an insecure manner. When the mktemp utility was not available, gzexe constructed a temporary file path based on the process ID, which could be predicted. A local attacker could possibly use this issue to overwrite arbitrary files via a symlink attack. (CVE-2026-41991) It was discovered that Gzip incorrectly handled certain compressed files. An attacker could possibly use this issue to obtain sensitive information or cause Gzip to crash, resulting in a denial of service. (CVE-2026-41992)","link":"https://ubuntu.com/security/notices/USN-8512-1","severity":"unknown","cvss":null,"cves":["CVE-2026-41991","CVE-2026-41992"],"exploited":false,"has_exploit":false,"published_at":"2026-07-06T12:52:06+00:00"},{"id":"fa30e323-a514-40a6-9685-b9065aa477c1","num":170034,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8511-1","title":"USN-8511-1: socat vulnerabilities","summary":"It was discovered that socat incorrectly handled the SOCKS5 proxy server reply parser. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-56123) It was discovered that socat incorrectly handled a sample script. A local attacker could possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-54661)","link":"https://ubuntu.com/security/notices/USN-8511-1","severity":"unknown","cvss":null,"cves":["CVE-2026-56123","CVE-2024-54661"],"exploited":false,"has_exploit":false,"published_at":"2026-07-06T12:37:17+00:00"},{"id":"3f6fb366-7361-40a4-a799-6dc34426e081","num":170035,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8510-1","title":"USN-8510-1: tar vulnerability","summary":"It was discovered that tar incorrectly handled symlinks when extracting archives. An attacker could possibly use this issue to overwrite arbitrary files.","link":"https://ubuntu.com/security/notices/USN-8510-1","severity":"unknown","cvss":null,"cves":["CVE-2025-45582"],"exploited":false,"has_exploit":false,"published_at":"2026-07-06T11:57:49+00:00"},{"id":"da43461c-b7c9-4feb-b207-a99458a07e48","num":170036,"source_id":"ubuntu","external_id":"https://ubuntu.com/security/notices/USN-8509-1","title":"USN-8509-1: Python vulnerabilities","summary":"It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462) It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534) It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299) It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502) It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297) It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2026-3276) It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644) It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of serv","link":"https://ubuntu.com/security/notices/USN-8509-1","severity":"unknown","cvss":null,"cves":["CVE-2025-13462","CVE-2025-69534","CVE-2026-1299","CVE-2026-1502","CVE-2026-2297","CVE-2026-3276","CVE-2026-3644","CVE-2026-4224","CVE-2026-4519","CVE-2026-4786","CVE-2026-5713","CVE-2026-6019","CVE-2026-6100","CVE-2026-7774","CVE-2021-4189","CVE-2026-8328","CVE-2026-9669"],"exploited":false,"has_exploit":false,"published_at":"2026-07-06T11:48:55+00:00"}]}