Security fixes and advisories that landed overnight. The list is ordered with higher-risk items first and vendor notices grouped by source. Entries draw only on vendor and NIST summaries and CVE listings where present. Updated 05 Nov 2026 00:00 GMT.
Top items
Ubuntu
USN-9000-1: Twisted vulnerability
Twisted’s IMAP server mishandles wildcard patterns in mailbox list commands. An authenticated remote attacker could cause excessive resource use leading to a denial of service.
- Published: 04 Nov 2026 16:24 GMT
- CVEs: Not stated in the advisory excerpt
- Notes: authenticated remote attacker may trigger excessive resource use
USN-8999-1: Pillow vulnerabilities
Pillow contains multiple flaws in image and font handling, including incorrect map stride handling for McIdas AREA images, decompression bomb checks, EPS parsing, JPEG2000 tile widths, and rank filter and colour management validation. Attackers could obtain sensitive information, cause excessive memory use or denial of service, cause crashes or execute arbitrary code; multiple CVEs are listed.
- Published: 04 Nov 2026 15:49 GMT
- CVEs: CVE-2026-54058, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205
- Notes: multiple vulnerabilities affect image parsing and decompression bomb checks
USN-8998-1: Squid vulnerability
Squid incorrectly handled certain HTTP Transfer-Encoding headers. An attacker could use this to perform HTTP request smuggling attacks, bypass security mechanisms or poison web caches.
- Published: 04 Nov 2026 15:32 GMT
- CVEs: Not stated in the advisory excerpt
- Notes: HTTP request smuggling and cache poisoning mentioned
USN-8997-1: Net-SNMP vulnerability
Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker could cause Net-SNMP to block indefinitely, resulting in a denial of service.
- Published: 04 Nov 2026 15:25 GMT
- CVEs: Not stated in the advisory excerpt
- Notes: unauthenticated remote attacker may cause indefinite blocking
USN-7530-2: ADOdb vulnerability
ADOdb was found to incorrectly handle SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.
- Published: 04 Nov 2026 15:14 GMT
- CVEs: Not stated in the advisory excerpt
- Notes: remote SQL execution via mishandled input
USN-8996-1: APT vulnerability
APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could trick APT into installing an unverified package and achieve remote code execution with root privileges.
- Published: 04 Nov 2026 13:37 GMT
- CVEs: Not stated in the advisory excerpt
- Notes: on-path attacker may cause installation of an unverified package
NIST
CVE-2026-121597
A stack-based buffer overflow was identified in the Easy Setup Wizard Handler’s setAppEasyWizardConfig function for TOTOLINK A950RG. The issue can be triggered remotely and exploit code has been made publicly available.
- Published: 04 Nov 2026 00:17 GMT
- CVEs: Not stated in the advisory excerpt
- Notes: stack-based buffer overflow in Easy Setup Wizard Handler
