Week: 2026-W14

Mariner

2026-04-03 CVE-2026-35386

lowMicrosoft CVE 2026-W14

netfilter: nft_set_rbtree: validate open interval overlap

2026-04-03 CVE-2026-23333

OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)

2026-04-03 CVE-2026-34978

usb: gadget: f_ncm: align net_device lifecycle with bind/unbind

2026-04-03 CVE-2026-23320

Addressable has a Regular Expression Denial of Service in Addressable templates

2026-04-02 CVE-2026-35611

Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0443

highBSI 2026-W14

apparmor: fix differential encoding verification

2026-04-02 CVE-2026-23409

apparmor: Fix double free of ns_name in aa_replace_profiles()

2026-04-02 CVE-2026-23408

apparmor: fix memory leak in verify_header

2026-04-02 CVE-2026-23403

apparmor: fix missing bounds check on DEFAULT table in verify_dfa()

2026-04-02 CVE-2026-23407

apparmor: fix race between freeing data and fs accessing it

2026-04-02 CVE-2026-23411

apparmor: fix race on rawdata dereference

2026-04-02 CVE-2026-23410

apparmor: fix side-effect bug in match_char() macro usage

2026-04-02 CVE-2026-23406

apparmor: fix: limit the number of levels of policy namespaces

2026-04-02 CVE-2026-23405

apparmor: replace recursive profile removal with iterative approach

2026-04-02 CVE-2026-23404

Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon

2026-04-02 CVE-2026-34933

Azure AI Foundry Elevation of Privilege Vulnerability

2026-04-02 CVE-2026-32213

criticalMicrosoft MSRC 2026-W14

Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability

2026-04-02 CVE-2026-26135

criticalMicrosoft MSRC 2026-W14

Azure Databricks Elevation of Privilege Vulnerability

2026-04-02 CVE-2026-33107

criticalMicrosoft MSRC 2026-W14

Azure MCP Server Information Disclosure Vulnerability

2026-04-02 CVE-2026-32211

criticalMicrosoft MSRC 2026-W14

Azure SRE Agent Information Disclosure Vulnerability

2026-04-02 CVE-2026-32173

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

2026-04-02 CVE-2026-31408

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

2026-04-02 CVE-2026-33810

Checkmk: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

2026-04-02 WID-SEC-2026-0820

mediumBSI 2026-W14

Cisco Nexus Dashboard und Insights: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0955

mediumBSI 2026-W14

Code execution vulnerability in SWIG code generation in cmd/go

2026-04-02 CVE-2026-27140

criticalMicrosoft MSRC 2026-W14

CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

2026-04-02 CVE-2026-39316

CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

2026-04-02 CVE-2026-39314

cURL: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0690

mediumBSI 2026-W14

Devolutions Server: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0958

highBSI 2026-W14

Docker Desktop Model Runner: Schwachstelle ermöglicht Offenlegung von Informationen

2026-04-02 WID-SEC-2026-0922

mediumBSI 2026-W14

Drupal (SAML SSO): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

2026-04-02 WID-SEC-2026-0954

mediumBSI 2026-W14

Golang Go: Mehrere Schwachstellen

2026-04-02 WID-SEC-2025-2724

mediumBSI 2026-W14

Golang Go: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0345

highBSI 2026-W14

Google Cloud Platform Envoy Proxy, Istio und Service Mesh: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0704

mediumBSI 2026-W14

HCL BigFix Platform: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0960

highBSI 2026-W14

Heap Buffer Overflow in Hexadecimal Conversion

2026-04-02 CVE-2026-31789

IBM DataPower Gateway: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0924

mediumBSI 2026-W14

IBM DataPower Gateway: Schwachstelle ermöglicht Offenlegung von Informationen

2026-04-02 WID-SEC-2026-0906

lowBSI 2026-W14

IGEL UMS: Schwachstelle ermöglicht Offenlegung von Informationen

2026-04-02 WID-SEC-2026-0957

highBSI 2026-W14

ImageMagick: Mehrere Schwachstellen

2026-04-02 WID-SEC-2026-0499

lowBSI 2026-W14

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

2026-04-02 CVE-2026-31790

Inefficient policy validation in crypto/x509

2026-04-02 CVE-2026-32281

ipv6: add NULL checks for idev in SRv6 paths

2026-04-02 CVE-2026-23442

JsBraceDepth Context Tracking Bugs (XSS) in html/template

2026-04-02 CVE-2026-32289

ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION

2026-04-02 CVE-2026-31410

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

2026-04-02 CVE-2026-23401

highMicrosoft CVE 2026-W14

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

2026-04-02 CVE-2026-4878

Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins

2026-04-02 CVE-2026-35093

LIBPNG has a yse-after-free in png_set_PLTE, png_set_tRNS and png_set_hIST leading to corrupted chunk data and potential heap information disclosure

2026-04-02 CVE-2026-34757