Oracle Linux 10 : tomcat (ELSA-2026-69259)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69259 advisory. - Resolves: RHEL-192817 tomcat: HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-192648 tomcat: Improper Input Validation...

CVE-2026-73513: Improper Input Validation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without ENDSTREAM. Envoy completes and deferred-deletes the ActiveRequest...

CVE-2026-73550: Missing Release of Memory after Effective Lifetime

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection

Large language models LLMs are increasingly deployed in production systems, raising concerns about their exposure to adversarial manipulation through prompt injection and jailbreak attacks. Classifier-based guardrails, such as Prompt Guard 2, are widely used as a first line of defense against suc...

PT-2026-105023

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

CVE-2026-94184: Stack-based Buffer Overflow

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

Linux Distros Unpatched Vulnerability : CVE-2026-93492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This...

TencentOS Server 2: gdk-pixbuf2 (TSSA-2026:1038)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1038 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

TencentOS Server 2: kernel (TSSA-2026:1024)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1024 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Oracle Linux 9 : sudo (ELSA-2026-69123)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-69123 advisory. 1.9.17p2-3.1 - CVE-2026-82474 sudo: execveat2 intercept/logsubcmds bypass Resolves: RHEL-255647 Tenable has extracted the preceding description block directly...

TencentOS Server 2: python-tornado (TSSA-2026:1040)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1040 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 2: bind (TSSA-2026:1039)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1039 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

TencentOS Server 2: freerdp (TSSA-2026:1042)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1042 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-93567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNE...

Linux Distros Unpatched Vulnerability : CVE-2026-93579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage...

PT-2026-96115

Name of the Vulnerable Software and Affected Versions fetchmail versions 5.0.8 through 6.6.6 Description A stack-based buffer overflow occurs in fetchmail when it is compiled with NTLM support. A malicious or compromised mail server that advertises NTLM authentication can send a specially crafted...

CLSA-2026-1789901057 TuxCare security update for 11 packages (2 CVEs)

TuxCare rebuilt 11 packages to address 2 CVEs. Fixed in 4.0.18-tuxcare.2...

SUSE CVE-2026-45764

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash,...

PT-2026-95903

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.7 Description A use-after-free flaw exists in the Http2ThreadMultiBuf component. This occurs when the system inspects HTTP/2 transactions using rules that apply http.response header both with and without a...

SUSE CVE-2026-86250

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On^2 cleanup loop that hangs the server...