Debian dsa-6338 : libdbi-perl - security update

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6338 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6338-1 [email protected]...

PT-2026-80296

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-1 5 encrypted key material unless operators explicitly reconfigured the flag...

CVE-2026-40996: Use of a Broken or Risky Cryptographic Algorithm

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators explicitly reconfigured the flag...

CVE-2026-46705 russh server userauth state is not reset when authentication principal changes

Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSHMSGUSERAUTHREQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user nam...

CVE-2026-27145 affecting package golang for versions less than 1.25.11-1

CVE-2026-27145 affecting package golang for versions less than 1.25.11-1. A patched version of the package is available...

CVE-2026-27145 affecting package golang for versions less than 1.26.4-1

CVE-2026-27145 affecting package golang for versions less than 1.26.4-1. A patched version of the package is available...

CVE-2026-42504 affecting package golang for versions less than 1.25.11-1

CVE-2026-42504 affecting package golang for versions less than 1.25.11-1. A patched version of the package is available...

CVE-2026-42504 affecting package golang for versions less than 1.26.4-1

CVE-2026-42504 affecting package golang for versions less than 1.26.4-1. A patched version of the package is available...

CVE-2026-44185 affecting package httpd for versions less than 2.4.68-1

CVE-2026-44185 affecting package httpd for versions less than 2.4.68-1. A patched version of the package is available...

CVE-2026-29167 affecting package httpd for versions less than 2.4.68-1

CVE-2026-29167 affecting package httpd for versions less than 2.4.68-1. A patched version of the package is available...

CVE-2026-42507 affecting package golang for versions less than 1.26.4-1

CVE-2026-42507 affecting package golang for versions less than 1.26.4-1. A patched version of the package is available...

CVE-2026-42507 affecting package golang for versions less than 1.25.11-1

CVE-2026-42507 affecting package golang for versions less than 1.25.11-1. A patched version of the package is available...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.19.0-1.hum1 aarch64, x8664 jaeger-2.19.0-1.hum1.src src...

CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1

CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-23679 affecting package libusb for versions less than 1.0.30-1

CVE-2026-23679 affecting package libusb for versions less than 1.0.30-1. A patched version of the package is available...

[SECURITY] Fedora 43 Update: xorg-x11-server-21.1.23-1.fc43

X.Org X11 X server...

[SECURITY] Fedora 43 Update: putty-0.84-1.fc43

Putty is a SSH, Telnet & Rlogin client - this time for Linux...

Russh 授权问题漏洞

Russh is a Rust SSH client and server library developed by Eugene as a personal project. In versions of Russh from 0.34.0-beta.1 to 0.61.0, there was an authorization vulnerability. This vulnerability stemmed from the server authentication path not separating the internal authentication state whe...

EUVD-2026-35476

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application Denial of Service or to...

AZL-89805 CVE-2026-42766 affecting package openssl-fips-provider 3.1.2-2

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is define...