CVE-2026-33930 Apache Traffic Server: Buffer overflow via Host field that has a long string value

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through...

CVE-2026-33930

Apache Traffic Server is affected by a buffer overflow in the handling of redirect requests caused by copying a long Host header into a fixed-size stack buffer. Affected versions are 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upgrading to 9.2.15 or 10.1.4 fixes the issue. The CVE describes an ...

CVE-2026-33930

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through...

libXfont2 security update

An update is available for libXfont2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list X.Org X11 libXfont2 runtime library Security Fixes: libXfont2:...

RLSA-2026:47103 Important: libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fixes: libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 libXfont2: PCF Font Parsing Heap Buffer Overflow CVE-2026-56002 libXfont2: computeProps Property Buffer Heap Buffer Overflow CVE-2026-56003 For more details about...

Oracle Linux 8 : libtiff (ELSA-2026-47184)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47184 advisory. 4.0.9-38 - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 RHEL-189371 Tenable has extracted the preceding description block...

NewStart CGSL MAIN 6.06 : gd Multiple Vulnerabilities (NS-SA-2026-0053)

The remote NewStart CGSL host, running version MAIN 6.06, has gd packages installed that are affected by multiple vulnerabilities: - The GD Graphics Library aka LibGD 2.2.5 has a double free in the gdImagePtr functions in gdgifout.c, gdjpeg.c, and gdwbmp.c. NOTE: PHP is unaffected. CVE-2019-6978 ...

PT-2026-65964

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

PT-2026-65943

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

PT-2026-65955

GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a...

RockyLinux 9 : postgresql (RLSA-2026:27741)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:27741 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq:...

RockyLinux 8 : libXfont2 (RLSA-2026:47103)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47103 advisory. libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 libXfont2: PCF Font Parsing Heap Buffer Overflow CVE-2026-56002...

PT-2026-65953

GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a...

PT-2026-65954

Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description A stack-based buffer overflow exists in the OGG file parsing component. The issue occurs because the software fails to properly validate the length of user-supplied data before copying it t...

PT-2026-65959

GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

Oracle Linux 8 : compat-libtiff3 (ELSA-2026-47183)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-47183 advisory. 3.9.4-16 - fix CVE-2026-12912: heap-buffer-overflow in PixarLog ABGR decoding RHEL-189375 Tenable has extracted the preceding description block directly from t...

PT-2026-65938

Name of the Vulnerable Software and Affected Versions Kenwood DNR1007XR affected versions not specified Description A heap-based buffer overflow exists in the vCardParser class. The issue occurs because the software fails to properly validate a user-supplied string before copying it to a heap-bas...

PT-2026-65944

Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exist...

MiracleLinux 9 : postgresql:15 (AXSA:2026-1374:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1374:01 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libp...

NewStart CGSL MAIN 6.06 : edk2 Multiple Vulnerabilities (NS-SA-2026-0057)

The remote NewStart CGSL host, running version MAIN 6.06, has edk2 packages installed that are affected by multiple vulnerabilities: - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. CVE-2021-38578 - EDK2 is susceptible to a vulnerability in the...