CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

null — security advisories

79 advisorieslatest 2026-07-03⚡ RSS feed

Tracked null products:

Chromium null KVM SSH SFTP server Elasticsearch ksmbd net sctp libpng cilium netfilter libssh2 GnuPG batman-adv gfs2 wifi acl containerd libslirp Jenkins Exim tun selinux drm/vkms hfsplus platform/x86 Vim Glib openvswitch i2c

⚡ Watch null

Get an email when a new null advisory drops — max one per day, one-click unsubscribe.

Citrix Products Multiple Vulnerabilities

unknownCVE-2026-8451 CVE-2026-8452 CVE-2026-8655 CVE-2026-10816hkcert2026-07-03

CVE-2026-12413: IKEv2 Denial of Service via malformed fragmentation

highCVSS 7.5CVE-2026-12413msrc2026-07-02

CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role

highCVSS 7CVE-2026-53359msrc2026-07-02

CVE-2026-54886: SSH SFTP server denial of service via extended channel data infinite loop

unknownCVE-2026-54886msrc2026-07-02

CVE-2026-49090: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

mediumCVSS 6.5CVE-2026-49090msrc2026-07-02

CVE-2026-14122: Chromium: CVE-2026-14122 Insufficient validation of untrusted input in WebAppInstalls

unknownCVE-2026-14122msrc2026-07-02

CVE-2026-14146: Chromium: CVE-2026-14146 Inappropriate implementation in CSS

unknownCVE-2026-14146msrc2026-07-02

CVE-2026-14052: Chromium: CVE-2026-14052 Insufficient policy enforcement in FileSystem

unknownCVE-2026-14052msrc2026-07-02

CVE-2026-13977: Chromium: CVE-2026-13977 Inappropriate implementation in HTMLParser

unknownCVE-2026-13977msrc2026-07-02

CVE-2026-13942: Chromium: CVE-2026-13942 Insufficient validation of untrusted input in Video Capture

unknownCVE-2026-13942msrc2026-07-02

Issue with containerd CRI Plugin - CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262

unknownCVE-2026-50195 CVE-2026-53488 CVE-2026-53492 CVE-2026-53489aws2026-06-19

CVE-2026-40930: LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body

mediumCVSS 5.4CVE-2026-40930msrc2026-06-09

CVE-2026-10722: cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow

lowCVSS 3.3CVE-2026-10722msrc2026-06-09

CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued

highCVSS 7.8CVE-2026-52912msrc2026-06-09

CVE-2026-58050: libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation

highCVSS 7CVE-2026-58050msrc2026-06-09

CVE-2026-57062: CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

lowCVSS 2.9CVE-2026-57062msrc2026-06-09

CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment

mediumCVSS 5.5CVE-2026-52916msrc2026-06-09

CVE-2026-53049: gfs2: add some missing log locking

criticalCVSS 9.8CVE-2026-53049msrc2026-06-09

CVE-2026-53113: wifi: ath11k: fix memory leaks in beacon template setup

mediumCVSS 5.5CVE-2026-53113msrc2026-06-09

CVE-2026-54369: acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

highCVSS 7.1CVE-2026-54369msrc2026-06-09

CVE-2026-53043: ocfs2/dlm: validate qr_numregions in dlm_match_regions()

criticalCVSS 9.8CVE-2026-53043msrc2026-06-09

CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy

highCVSS 7.1CVE-2026-53212msrc2026-06-09

CVE-2026-53177: bnxt_en: Fix NULL pointer dereference

mediumCVSS 5.5CVE-2026-53177msrc2026-06-09

CVE-2026-53021: scsi: target: core: Fix integer overflow in UNMAP bounds check

mediumCVSS 6.1CVE-2026-53021msrc2026-06-09

CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy

mediumCVSS 5.5CVE-2026-53109msrc2026-06-09

CVE-2026-53060: dm cache metadata: fix memory leak on metadata abort retry

mediumCVSS 5.5CVE-2026-53060msrc2026-06-09

CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

highCVSS 7.1CVE-2026-53230msrc2026-06-09

CVE-2026-9539: libslirp TCP URG OOB Read Information Leak

mediumCVSS 6.5CVE-2026-9539msrc2026-06-09

CVE-2026-52948: i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl

mediumCVSS 5.5CVE-2026-52948msrc2026-06-09

CVE-2026-47242: Net::IMAP: Command Injection via ID command argument

unknownCVE-2026-47242msrc2026-06-09

CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

highCVSS 7.4CVE-2026-34181msrc2026-06-09

CVE-2026-46250: MIPS: Work around LLVM bug when gp is used as global register variable

mediumCVSS 4.4CVE-2026-46250msrc2026-06-09

CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

highCVSS 7CVE-2026-53239msrc2026-06-09

CVE-2026-53017: f2fs: fix data loss caused by incorrect use of nat_entry flag

criticalCVSS 9.8CVE-2026-53017msrc2026-06-09

CVE-2026-53003: pppoe: drop PFC frames

mediumCVSS 5.5CVE-2026-53003msrc2026-06-09

CVE-2026-52931: batman-adv: tp_meter: avoid use of uninit sender vars

criticalCVSS 9.8CVE-2026-52931msrc2026-06-09

CVE-2026-52911: ksmbd: scope conn->binding slowpath to bound sessions only

highCVSS 8.4CVE-2026-52911msrc2026-06-09

CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure

mediumCVSS 5.5CVE-2026-52974msrc2026-06-09

CVE-2026-52929: sctp: stream: fully roll back denied add-stream state

mediumCVSS 5.5CVE-2026-52929msrc2026-06-09

CVE-2026-10941: Chromium: CVE-2026-10941 Out of bounds memory access in Skia

unknownCVE-2026-10941msrc2026-06-09

CVE-2026-10913: Chromium: CVE-2026-10913 Use after free in ANGLE

unknownCVE-2026-10913msrc2026-06-09

CVE-2026-10926: Chromium: CVE-2026-10926 Use after free in Cast

unknownCVE-2026-10926msrc2026-06-09

CVE-2026-10937: Chromium: CVE-2026-10937 Inappropriate implementation in Passwords

unknownCVE-2026-10937msrc2026-06-09

CVE-2026-10938: Chromium: CVE-2026-10938 Insufficient validation of untrusted input in Input

unknownCVE-2026-10938msrc2026-06-09

CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one()

mediumCVSS 5.5CVE-2026-46321msrc2026-06-09

CVE-2026-46302: selinux: allow multiple opens of /sys/fs/selinux/policy

mediumCVSS 5.5CVE-2026-46302msrc2026-06-09

CVE-2025-71315: drm/vkms: Convert to DRM's vblank timer

mediumCVSS 5.5CVE-2025-71315msrc2026-06-09

CVE-2026-46299: hfsplus: fix held lock freed on hfsplus_fill_super()

mediumCVSS 5.5CVE-2026-46299msrc2026-06-09

CVE-2026-53022: platform/x86: dell-wmi-sysman: bound enumeration string aggregation

mediumCVSS 5.5CVE-2026-53022msrc2026-06-09

CVE-2026-53215: net: mvpp2: refill RX buffers before XDP or skb use

highCVSS 7.8CVE-2026-53215msrc2026-06-09

CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode()

highCVSS 7.5CVE-2026-52955msrc2026-06-09

CVE-2026-53025: greybus: raw: fix use-after-free on cdev close

criticalCVSS 9.8CVE-2026-53025msrc2026-06-09

CVE-2026-57455: Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

highCVSS 7.8CVE-2026-57455msrc2026-06-09

CVE-2026-58013: Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

mediumCVSS 6.5CVE-2026-58013msrc2026-06-09

CVE-2026-6450: CRL critical extension bypass in ParseCRL_Extensions

mediumCVSS 5.3CVE-2026-6450msrc2026-06-09

CVE-2026-53157: net: phonet: free phonet_device after RCU grace period

highCVSS 7.8CVE-2026-53157msrc2026-06-09

CVE-2026-6731: X.509 name constraint bypass via Subject CN treated as a DNS name

highCVSS 7.5CVE-2026-6731msrc2026-06-09

CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

mediumCVSS 5.5CVE-2026-53221msrc2026-06-09

CVE-2026-57452: Vim: Out-of-bounds Read with libsodium-encrypted Files

mediumCVSS 5.5CVE-2026-57452msrc2026-06-09

CVE-2026-53229: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure

mediumCVSS 5.5CVE-2026-53229msrc2026-06-09

CVE-2026-6330: ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

mediumCVSS 6.5CVE-2026-6330msrc2026-06-09

CVE-2026-10512: X25519 x86_64 assembly final reduction leaves non-canonical field element

highCVSS 7.5CVE-2026-10512msrc2026-06-09

CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR

mediumCVSS 5.5CVE-2026-53227msrc2026-06-09

CVE-2026-12143: form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

highCVSS 7.5CVE-2026-12143msrc2026-06-09

CVE-2026-43973: gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

unknownCVE-2026-43973msrc2026-06-09

CVE-2026-53195: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()

highCVSS 7.1CVE-2026-53195msrc2026-06-09

CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

mediumCVSS 5.3CVE-2026-42769msrc2026-06-09

CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption

mediumCVSS 5.9CVE-2026-42767msrc2026-06-09

CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing

highCVSS 7.5CVE-2026-34180msrc2026-06-09

CVE-2026-46322: tun: free page on build_skb failure in tun_xdp_one()

mediumCVSS 6.1CVE-2026-46322msrc2026-06-09

CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption

mediumCVSS 5.9CVE-2026-42766msrc2026-06-09

CVE-2026-48855: SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured

mediumCVSS 6.5CVE-2026-48855msrc2026-06-09

CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

highCVSS 7.5CVE-2026-34183msrc2026-06-09

CVE-2026-10884: Chromium: CVE-2026-10884 Use after free in Chromecast

unknownCVE-2026-10884msrc2026-06-09

CVE-2026-0251 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)

mediumCVE-2026-0251paloalto2026-06-02

Jenkins Security Advisory 2023-11-29

unknownCVE-2023-49653 CVE-2023-49652 CVE-2023-49654 CVE-2023-49655jenkins2023-11-29

Jenkins Security Advisory 2023-10-25

unknownCVE-2023-46650 CVE-2023-46651 CVE-2023-46652 CVE-2023-46653jenkins2023-10-25

Multiple vulnerabilities in Exim (October 2, 2023)

unknownCVE-2023-42117 CVE-2023-42118 CVE-2023-42119 CVE-2023-42114cert-fr-alerte2023-10-02

Jenkins Security Advisory 2023-09-20

unknownCVE-2023-43494 CVE-2023-43495 CVE-2023-43496 CVE-2023-43497jenkins2023-09-20

null security advisories · CSIRTS