Linux Distros Unpatched Vulnerability : CVE-2026-74954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154,...

Linux Distros Unpatched Vulnerability : CVE-2026-74959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103697)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103697 advisory. The BIND resolver accepts validly-signed NSEC records where the Next Domain Name field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0...

Linux Distros Unpatched Vulnerability : CVE-2026-75625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying on...

MiracleLinux 8 : bind-9.11.36-16.el8_10.14 (AXSA:2026-1553:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1553:08 advisory. bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-13321 bind: bind9: Potential memory usage beyond configured limits...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103699)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103699 advisory. It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This...

MiracleLinux 8 : unbound-1.16.2-5.14.el8_10 (AXSA:2026-1573:10)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1573:10 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding...

AlmaLinux 9 : bind9.18 (ALSA-2026:55442)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55442 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-133...

Oracle Linux 9 : bind9.18 (ELSA-2026-55442)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55442 advisory. - Fix NSEC3 signer validation CVE-2026-10723, RHEL-215704 - Reject out-of-zone NSEC next owner names CVE-2026-13321, RHEL-213314 - Fix cache exhaustio...

CVE-2026-16732

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

CVE-2026-16732 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

CVE-2026-16732 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

jmespath.php has CompilerRuntime code injection via unescaped function names

Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression...

GHSA-PCW8-M77R-2528 jmespath.php has CompilerRuntime code injection via unescaped function names

Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression...

CVE-2026-74959

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Storage: Cache API component...

CVE-2026-52736 ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data...

EUVD-2026-61171

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data...

CVE-2026-52736

In Zebra versions up to v4.4.1, a remote unauthenticated P2P peer can poison the in-memory non_finalized_block_write_sent_hashes cache by racing an invalid block body sharing a header hash (via ZIP-244 scriptSig malleability). When the valid canonical body arrives, it is treated as a duplicate an...

CVE-2026-52736 ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data...

CVE-2026-52736 ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data...