Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 828 articles for you...
197
security advisorylocal privilege escalationdebianDebian libinput Important Code Execution Vulnerability DLA-4626-1
Two vulnerabilities were found in libinput, an input device management and event handling library. CVE-2022-1215 libinput did not properly handled evdev devices, which may potentially be exploited by malicious local users in specific setup to execute arbitrary. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4626-1
Jun 11, 2026
•Important
Debian LTS
202
security advisoryimportantOpenSUSEopenSUSE Backports SLE-15-SP7 Python-Simpleeval Sandbox Access Issue
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for python-simpleeval ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0087-1 Rating: important References: #1259685 Cross-References: CVE-2026-32640 Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-simpleeval fixes the following issues: - CVE-2026-32640: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox (boo#1259685) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-87=1 Package List: - openSUSE Backports SLE-15-SP7 (noarch): python311-simpleeval-0.9.13-bp157.2.3.1 References: https://www.suse.com/security/cve/CVE-2026-32640.html https://bugzilla.suse.com/1259685 . An important update for openSUSE fixes a security flaw in python-simpleeval, which allowed module leakage in the sandbox.. openSUSE updates, python-simpleeval security, module leakage fix, sandbox access vulnerabilities. . Severity: Important. LinuxSecurity.com Team
Jun 11, 2026
•Important
OpenSUSE
202
security advisorySQL InjectionXSSopenSUSE Roundcubemail Important XSS SQL Injection Fix Advisory 2026-0183-1
An update that fixes 8 vulnerabilities is now available.. openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0183-1 Rating: important References: #1266329 #1266331 #1266332 #1266333 #1266334 #1266335 #1266336 #1266337 Cross-References: CVE-2026-48842 CVE-2026-48843 CVE-2026-48844 CVE-2026-48845 CVE-2026-48846 CVE-2026-48847 CVE-2026-48848 CVE-2026-48849 Affected Products: openSUSE Backports SLE-15-SP6 openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Update to 1.6.16 - Fix potential too long value in IMAP ID command (#10136) - CVE-2026-48849: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [boo#1266337] - CVE-2026-48848: Fix CSS injection bypass in HTML sanitizer via SVG [boo#1266336] - CVE-2026-48842: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [boo#1266329] - CVE-2026-48843: Fix SSRF bypass via specific local address URLs [boo#1266331] - CVE-2026-48846: Fix bypass of remote image blocking via CSS var() [boo#1266334] - CVE-2026-48845: Fix local/private URL fetch bypass when remote resources were not allowed [boo#1266333] - CVE-2026-48847: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [boo#1266335] - CVE-2026-48844: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [boo#1266332] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2026-183=1 - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2026-183=1 Package List: - openSUSE Backports SLE-15-SP7 (noarch): roundcubemail-1.6.16-bp157.2.12.1 - openSUSE Backports SLE-15-SP6 (noarch): roundcubemail-1.6.16-bp156.2.18.1 References: https://www.suse.com/security/cve/CVE-2026-48842.html https://www.suse.com/security/cve/CVE-2026-48843.html https://www.suse.com/security/cve/CVE-2026-48844.html https://www.suse.com/security/cve/CVE-2026-48845.html https://www.suse.com/security/cve/CVE-2026-48846.html https://www.suse.com/security/cve/CVE-2026-48847.html https://www.suse.com/security/cve/CVE-2026-48848.html https://www.suse.com/security/cve/CVE-2026-48849.html https://bugzilla.suse.com/1266329 https://bugzilla.suse.com/1266331 https://bugzilla.suse.com/1266332 https://bugzilla.suse.com/1266333 https://bugzilla.suse.com/1266334 https://bugzilla.suse.com/1266335 https://bugzilla.suse.com/1266336 https://bugzilla.suse.com/1266337 . OpenSUSE delivers security updates addressing 8 vulnerabilities in RoundcubeMail ensuring protection against critical risks.. openSUSE updates, RoundcubeMail vulnerabilities, SQL injection, security fixes. . Severity: Important. LinuxSecurity.com Team
Jun 11, 2026
•Important
OpenSUSE
202
security advisorymoderatebuffer overflowopenSUSE Shadowsocks-V2ray-Plugin Moderate Update CVE-2025-297850
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for shadowsocks-v2ray-plugin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2025:0366-1 Rating: moderate References: #1243954 Cross-References: CVE-2025-297850 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shadowsocks-v2ray-plugin fixes the following issues: Update version to 5.37.0 * Update v2ray-core to 5.37.0 * Fixed CVE-2025-29785 in dependency ackhandler (bsc#1243954) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2025-366=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): shadowsocks-v2ray-plugin-5.37.0-bp156.2.6.1 - openSUSE Backports SLE-15-SP6 (noarch): golang-github-teddysun-v2ray-plugin-5.37.0-bp156.2.6.1 References: https://www.suse.com/security/cve/CVE-2025-297850.html https://bugzilla.suse.com/1243954 . Update for shadowsocks-v2ray-plugin fixes CVE-2025-297850 on openSUSE. Ensure your system is secure with this patch.. openSUSE security update, shadowsocks-v2ray-plugin patch, CVE-2025-297850, SLE-15-SP6 update. . Severity: moderate. LinuxSecurity.com Team
Jun 11, 2026
•moderate
OpenSUSE
202
security advisorymoderatebuffer overflowopenSUSE Kanidm Moderate Buffer Overflow Issue 2025-0152-1
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for kanidm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2025:0152-1 Rating: moderate References: #1242642 Cross-References: CVE-2025-3416 CVSS scores: CVE-2025-3416 (SUSE): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for kanidm fixes the following issues: - Update to version 1.6.2~git0.a20663ea8: * Release 1.6.2 * fix: clippy * maint: typo in log message * Set kid manually to prevent divergence * Order keys in application JWKS / Fix rotation bug * Fix toml issues with strings - Update to version 1.6.1~git0.2e4429eca: * Release 1.6.1 * Resolve reload of oauth2 on startup (#3604) - CVE-2025-3416: Fixed openssl use after free (boo#1242642) - Update to version 1.6.0~git0.d7ae0f336: * Release 1.6.0 * Avoid openssl for md4 * Fixes #3586, inverts the navbar button color (#3593) * Release 1.6.0-pre * chore: Release Notes (#3588) * Do not require instances to exist during optional config load (#3591) * Fix std::fmt::Display for some objects (#3587) * Drop fernet in favour of JWE (#3577) * docs: document how to configure oauth2 for opkssh (#3566) * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585) * Bump the all group in /pykanidm with 2 updates (#3581) * Update dependencies, fix a bunch of clippy lints (#3576) * Support spaces in ssh key comments (#3575) * 20250402 3423 proxy protocol (#3542) * fix(web): Preserve SSH key content on form validation error (#3574) * Bump the all group in /pykanidm with 3updates (#3572) * Bump the all group in /pykanidm with 2 updates (#3564) * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560) * Improve token handling (#3553) * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549) * Update fs4 and improve klock handling (#3551) * Less footguns (#3552) * Unify unix config parser (#3533) * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544) * Bump the all group in /pykanidm with 8 updates (#3547) * implement notify-reload protocol (#3540) * Allow versioning of server configs (#3515) * 20250314 remove protected plugin (#3504) * Bump the all group with 10 updates (#3539) * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538) * Bump the all group in /pykanidm with 4 updates (#3537) * Add max_ber_size to freeipa sync (#3530) * Bump the all group in /pykanidm with 5 updates (#3524) * Update Concread * Update developer_ethics.md (#3520) * Update examples.md (#3519) * Make schema indexing a boolean instead of index types (#3517) * Add missing lld dependency and fix syntax typo (#3490) * Update shell.nix to work with stable nixpkgs (#3514) * Improve unixd tasks channel comments (#3510) * Update kanidm_ppa_automation reference to latest (#3512) * Add set-description to group tooling (#3511) * packaging: Add kanidmd deb package, update documentation (#3506) * Bump the all group in /pykanidm with 5 updates (#3508) * 20250313 unixd system cache (#3501) * Support rfc2307 memberUid in sync operations. (#3466) * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496) * Update Traefik config example to remove invalid label (#3500) * Add uid/gid allocation table (#3498) * 20250225 ldap testing in testkit (#3460) * Bump the all group in /pykanidm with 5 updates (#3494) * Bump ring from 0.17.10 to 0.17.13 in the cargogroup (#3491) * Handle form-post as a response mode (#3467) * book: fix english (#3487) * Correct paths with Kanidm Tools Container (#3486) * 20250225 improve test performance (#3459) * Bump the all group in /pykanidm with 8 updates (#3484) * Use lld by default on linux (#3477) * 20250213 patch used wrong acp (#3432) * Android support (#3475) * Changed all CI/CD builds to locked (#3471) * Make it a bit clearer that providers are needed (#3468) * Fix incorrect credential generation in radius docs (#3465) * Add crypt formats for password import (#3458) * build: Create daemon image from scratch (#3452) * address webfinger doc feedbacks (#3446) * Bump the all group across 1 directory with 5 updates (#3453) * [htmx] Admin ui for groups and users management (#3019) * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431) * Accept invalid certs and fix token_cache_path (#3439) * Accept lowercase ldap pwd hashes (#3444) * TOTP label verification (#3419) * Rewrite WebFinger docs (#3443) * doc: fix formatting of URL table, remove Caddyfile instructions (#3442) * book: add OAuth2 Proxy example (#3434) * Exempt idm_admin and admin from denied names. (#3429) * Book fixes (#3433) * ci: uniform Docker builds (#3430) * 20240213 3413 domain displayname (#3425) * Correct path to kanidm config example in documentation. (#3424) * Support redirect uris with query parameters (#3422) * Update to 1.6.0-dev (#3418) * Remove white background from square logo. (#3417) * feat: Added webfinger implementation (#3410) * Bump the all group in /pykanidm with 7 updates (#3412) - Update to version 1.5.0~git2.21c2a1bd0: * fix: documentation fail (#3555) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run thecommand listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2025-152=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 x86_64): kanidm-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-clients-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-clients-debuginfo-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-debuginfo-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-debugsource-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-docs-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-server-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-server-debuginfo-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-unixd-clients-1.6.2~git0.a20663ea8-bp156.29.1 kanidm-unixd-clients-debuginfo-1.6.2~git0.a20663ea8-bp156.29.1 References: https://www.suse.com/security/cve/CVE-2025-3416.html https://bugzilla.suse.com/1242642 . Security update for openSUSE kanidm addresses moderate threat from CVE-2025-3416, improving system stability.. openSUSE kanidm security patch moderate CVE-2025-3416 update. . Severity: moderate. LinuxSecurity.com Team
Jun 11, 2026
•moderate
OpenSUSE
202
security advisorymoderatedenial of serviceopenSUSE assimp Serious Denial of Service CVE-2025-3548 Notice 2026-0045-1
An update that fixes one vulnerability is now available.. openSUSE Security Update: Security update for assimp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2026:0045-1 Rating: moderate References: #1241367 Cross-References: CVE-2025-3548 CVSS scores: CVE-2025-3548 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for assimp fixes the following issues: - CVE-2025-3548: Fixed denial of service when processing malformed files which may lead to an out-of-bounds read (boo#1241367). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2026-45=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 ppc64le s390x x86_64): assimp-devel-5.3.1-bp156.3.12.1 libassimp5-5.3.1-bp156.3.12.1 References: https://www.suse.com/security/cve/CVE-2025-3548.html https://bugzilla.suse.com/1241367 . Moderate security update for assimp on openSUSE to fix denial of service risk from malformed files.. openSUSE security update, assimp fix, denial of service, software vulnerability, SLE patch. . Severity: moderate. LinuxSecurity.com Team
Jun 11, 2026
•moderate
OpenSUSE
89
security advisorysecurity issuefedoraFedora 43kernel Important CVE-2025-10263 Fix for aarch64 CPUs
The 7.0.12-101/201 updates contain fixes for CVE-2025-10263. This CVE, while important, only impacts specific aarch64 CPUs.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-75fcc75b5f 2026-06-12 01:07:40.519563+00:00 -------------------------------------------------------------------------------- Name : kernel Product : Fedora 43 Version : 7.0.12 Release : 101.fc43 URL : https://www.kernel.org/ Summary : The Linux kernel Description : The kernel meta package -------------------------------------------------------------------------------- Update Information: The 7.0.12-101/201 updates contain fixes for CVE-2025-10263. This CVE, while important, only impacts specific aarch64 CPUs. -------------------------------------------------------------------------------- ChangeLog: * Wed Jun 10 2026 Justin M. Forbes [7.0.12-1] - New config setting for ARM64 Erratum (Justin M. Forbes) - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Shanker Donthineni) - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) - arm64: cputype: Add C1-Premium definitions (Mark Rutland) - arm64: cputype: Add C1-Ultra definitions (Mark Rutland) -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-75fcc75b5f' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 11, 2026
•Important
Fedora
89
security advisorydenial of servicefedoraFedora 43 vaultwarden Critical DoS and Access Issues Fix 2026-264f9ef567
update to 1.36.0. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-264f9ef567 2026-06-12 01:07:40.519543+00:00 -------------------------------------------------------------------------------- Name : vaultwarden Product : Fedora 43 Version : 1.36.0 Release : 1.fc43 URL : https://github.com/dani-garcia/vaultwarden Summary : Unofficial Bitwarden compatible server Description : Unofficial Bitwarden compatible server. -------------------------------------------------------------------------------- Update Information: update to 1.36.0 -------------------------------------------------------------------------------- ChangeLog: * Wed Jun 3 2026 Jonathan Wright - 1.36.0-1 - update to 1.36.0 rhbz#2368636 - Fix bitwarden mobile app not working rhbz#2437599 - Fix CVE-2025-58160 vaultwarden: Tracing log pollution - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion * Sat Jan 17 2026 Fedora Release Engineering - 1.34.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Tue Jul 29 2025 Jonathan Wright - 1.34.2-1 - update to 1.34.2 rhbz#2368636 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2437473 - CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2437473 [ 2 ] Bug #2438166 - CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2438166 [ 3 ] Bug #2439261 - CVE-2026-26012 vaultwarden: Vaultwarden: Information disclosure due to bypassed collection permissions [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2439261 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-264f9ef567' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 11, 2026
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!