Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 7.4 | USN-8954-1 |
zlib vulnerability
Canonical, zlibCanonical Ubuntu Linux, zlib, Canonical Ubuntu
|
Ubuntu Security Notices | |||
|
USN-8954-1CVE-2026-85091zlib vulnerability
Executive summaryA flaw in zlib, a widely used data-compression library in Ubuntu, could let an attacker crash programs or possibly run code if they supply specially crafted input. The advisory does not give a severity rating, but it describes the impact as denial of service or arbitrary code execution. Canonical recommends applying the standard system update, which contains fixed zlib package versions for Ubuntu 26.10, 26.04 LTS, and 24.04 LTS. Technical summaryThe advisory describes a heap buffer overflow in zlib triggered through certain non-blocking write operations, reported by Ali Firas. An attacker could possibly exploit it to cause denial of service or arbitrary code execution, and the advisory does not state the required attack preconditions. The fixed packages are 1:1.3.dfsg+really1.3.2-3ubuntu1.1 for 26.10, 1:1.3.dfsg+really1.3.1-1ubuntu3.2 for 26.04 LTS, and 1:1.3.dfsg-3.1ubuntu2.3 for 24.04 LTS, covering zlib1g, zlib1g-dev, and related lib32z1, lib64z1, and libx32z1 packages. The advisory references CVE-2026-85091. No workaround, CVSS score, or exploitation-in-the-wild information is stated, and no detection guidance is provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8954-1 Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affects
Canonical Ubuntu Security TeamPublished
Read the advisory
|
|||||||
| Medium | n/a | USN-8953-1 |
OpenVPN vulnerability
Canonical, OpenVPNCanonical Ubuntu Linux, OpenVPN, Canonical Ubuntu
|
Ubuntu Security Notices | |||
|
USN-8953-1CVE-2026-84790OpenVPN vulnerability
Executive summaryCanonical's Ubuntu Security Team published notice USN-8953-1 about a flaw in OpenVPN, the virtual private network software, which could allow unintended access to network services. The notice says a remote authenticated user could possibly use the issue to impersonate other users. The recommended fix is to update the openvpn package to the fixed version for your Ubuntu release and then restart OpenVPN. Technical summaryThe flaw is described as OpenVPN incorrectly handling certificate subject fields, which the advisory presents as an impersonation issue exploitable by a remote authenticated user. The advisory does not state a CVSS score, and the attack preconditions beyond remote authentication are not stated. Fixed package versions are listed as openvpn 2.7.7-1ubuntu1.1 for 26.10 (stonking), 2.7.0-1ubuntu1.4 for 26.04 LTS (resolute), 2.6.19-0ubuntu0.24.04.5 for 24.04 LTS (noble), and 2.5.11-0ubuntu0.22.04.6 for 22.04 LTS (jammy). The advisory identifies CVE-2026-84790 and says that a restart of OpenVPN is needed after the update. No workarounds, affected version ranges, or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8953-1 ScoreNo CVSS score published. AffectsCanonicalOpenVPNCanonical Ubuntu LinuxOpenVPNCanonical Ubuntu
Canonical Ubuntu Security TeamPublished
Read the advisory
|
|||||||
| High | 7.6 | USN-8890-2 |
libsoup vulnerabilities
Canonical, libsoupCanonical Ubuntu Linux, Canonical Ubuntu, Canonical libsoup3, libsoup
|
Ubuntu Security Notices | |||
|
USN-8890-2CVE-2026-4271CVE-2026-5119CVE-2026-6324CVE-2026-663393 morelibsoup vulnerabilities
Executive summarySeveral security flaws were fixed in libsoup3, a networking library used by applications on Ubuntu 26.10. The advisory says the issues could allow denial of service, disclosure of sensitive information, security control bypass, or possibly code execution, but it does not give an overall severity rating. Ubuntu recommends updating libsoup3 to the fixed version delivered for Ubuntu 26.10. Technical summaryThe advisory describes several flaws in libsoup's handling of HTTP/2 requests and transfers, HTTPS proxy connections, chunked HTTP requests, proxy authentication credentials, and HTTP Range headers. Attackers are described as remote, and the advisory says the impacts range from denial of service to information disclosure, security control bypass, and possibly arbitrary code execution for one HTTP/2 connection issue (CVE-2026-85197). The advisory does not state the exact vulnerability classes, CVSS scores, or the specific package version numbers that fix the issues. It also does not state workarounds or detection guidance. The advisory says the fixes apply to libsoup3 on Ubuntu 26.10, and it notes that several issues only affected Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H AffectsCanonicallibsoupCanonical Ubuntu LinuxCanonical UbuntuCanonical libsoup3libsoup
Canonical Ubuntu Security TeamPublished
Read the advisory
|
|||||||
| High | 8.6 | USN-8951-1 |
c-ares vulnerabilities
Canonical, c-aresCanonical Ubuntu Linux, c-ares, Canonical Ubuntu
|
Ubuntu Security Notices | |||
|
USN-8951-1CVE-2020-22217CVE-2022-4904CVE-2026-69184CVE-2026-69186c-ares vulnerabilities
Executive summaryCanonical's notice USN-8951-1 covers several security flaws in c-ares, a library that performs asynchronous DNS name resolution, on supported Ubuntu releases from 16.04 LTS through 26.04 LTS. The advisory describes the issues as causing denial of service, and some as possibly allowing code execution on older releases. The vendor recommends updating to the fixed c-ares package versions listed in the notice, usually through a standard system update. Technical summaryThe flaws include incorrect parsing of certain SOA replies (CVE-2020-22217, affecting Ubuntu 16.04 and 18.04 only), mishandling of sortlist strings (CVE-2022-4904, affecting Ubuntu 16.04 only, with the advisory saying it could possibly lead to arbitrary code execution), improper limits on DNS compression pointer hops and assembled name lengths (CVE-2026-69184), and failure to validate record count fields before memory allocation (CVE-2026-69186, affecting Ubuntu 24.04 and 26.04 only). A remote attacker could possibly trigger these issues by sending crafted DNS responses, leading to crashes or excessive resource use. Fixed package versions are stated as libcares2 1.34.6-1ubuntu0.2 for 26.04, libcares2 1.27.0-1.0ubuntu1.1 for 24.04, libc-ares2 1.18.1-1ubuntu0.22.04.4 for 22.04, libc-ares2 1.15.0-1ubuntu0.5+esm1 for 20.04, libc-ares2 1.14.0-1ubuntu0.2+esm3 for 18.04, and libc-ares2 1.10.0-3ubuntu0.2+esm4 for 16.04. No workarounds are stated, and no CVSS scores, exploitation status, or detection guidance are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8951-1 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affects
Canonical Ubuntu Security TeamPublished
Read the advisory
|
|||||||
| High | 7.8 | USN-8949-1 |
Ghostscript vulnerabilities
Canonical, GhostscriptCanonical Ubuntu Linux, Canonical Ubuntu, Ghostscript
|
Ubuntu Security Notices | |||
|
USN-8949-1CVE-2026-101258CVE-2026-103226Ghostscript vulnerabilities
Executive summarySeveral security flaws were fixed in Ghostscript, a widely used tool for reading PostScript and PDF files, and Ubuntu has released updated packages for multiple Ubuntu versions. The advisory says an attacker could exploit these flaws if a user or automated system were tricked into processing a specially crafted file or document, and one flaw could potentially allow code execution after escaping the sandbox. The recommended action is to apply a standard system update that includes the fixed package versions listed in the advisory. Technical summaryThe advisory describes memory handling errors in Ghostscript when processing PostScript documents and converting certain fonts, plus improper validation of operands when loading fonts. One issue (CVE-2026-101258) could possibly let an attacker bypass the sandbox and execute arbitrary code, another (CVE-2026-103226) could cause a crash or possibly code execution, and a third has no CVE number listed. Exploitation requires that a user or automated system be tricked into processing a specially crafted file or document. Fixed package versions are given for libgs10 and libgs10-common on 26.10 and 26.04 LTS, libgs10 on 24.04 LTS, libgs9 and libgs9-common on 22.04, 20.04, 18.04 and 16.04 LTS, with the exact version strings as written in the advisory. The advisory does not state any workarounds, detection guidance, CVSS scores, or whether the issues are being exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8949-1 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H AffectsCanonicalGhostscriptCanonical Ubuntu LinuxCanonical UbuntuGhostscript
Canonical Ubuntu Security TeamPublished
Read the advisory
|
|||||||
| Critical | n/a | USN-8948-2 |
PHP vulnerabilities
Canonical, PHPCanonical Ubuntu Linux, PHP, Canonical Ubuntu
|
Ubuntu Security Notices | |||
|
USN-8948-2CVE-2026-109618CVE-2026-109619PHP vulnerabilities
Executive summaryUbuntu has released updates for PHP on older supported Ubuntu releases (14.04, 16.04, 18.04 and 20.04 LTS). The advisory says the flaws could let a remote attacker crash PHP or run programs through specially crafted network traffic, and it recommends updating PHP to the package versions listed. Technical summaryThe advisory describes two flaws: CVE-2026-109618, where PHP incorrectly handled out-of-memory conditions while processing requests, and CVE-2026-109619, where PHP incorrectly managed internal request state across worker reuse. Both are described as allowing a remote attacker to execute arbitrary code, and the overview also mentions crashes. The advisory does not state any attack preconditions beyond specially crafted network traffic, nor any workarounds or detection guidance. Fixed package versions are given per release: php7.4 7.4.3-4ubuntu2.29+esm5 on 20.04 LTS, php7.2 7.2.24-0ubuntu0.18.04.17+esm14 on 18.04 LTS, php7.0 7.0.33-0ubuntu0.16.04.16+esm22 on 16.04 LTS, and php5 5.5.9+dfsg-1ubuntu4.29+esm18 on 14.04 LTS. Ubuntu Pro is required for these fixes. The advisory does not state CVSS scores or whether exploitation has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from ubuntu.com/security/notices/USN-8948-2 ScoreNo CVSS score published. Affects
Canonical Ubuntu Security TeamPublished
Read the advisory
|
|||||||