Oracle Linux 9 : kernel (ELSA-2026-49212)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49212 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-213299 CVE-2026-64530 - ipc: limit nextid allocation to the valid I...

Photon OS 5.0: Net PHSA-2026-5.0-91-0726

An update of the net package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0726. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLES12 Security Update : google-cloud-sap-agent (SUSE-SU-2026:3471-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3471-1 advisory. This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:3473-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3473-1 advisory. This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

Linux Distros Unpatched Vulnerability : CVE-2026-64580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device...

MAL-2026-11533 Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

ILSpy v11.0-rc

ILSpy ILSpy is the open-source, cross-platform .NET assembly browser and decompiler. The desktop UI runs on Windows, Linux, and macOS built on Avalonia. Download: latest release | latest CI build master | Microsoft Store RTM versions only Decompiler Frontends Aside from the cross-platform desktop...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

CLSA-2026-1773015250 TuxCare security update for net.minidev (1 CVE)

TuxCare rebuilt 2 net.minidev packages to address 1 CVE. Fixed in 1.3.2-tuxcare.2...

CLSA-2026-1770682157 TuxCare security update for net.i2p.crypto:eddsa (1 CVE)

TuxCare rebuilt net.i2p.crypto:eddsa to address 1 CVE. Fixed in 0.3.0-tuxcare.1...

CLSA-2025-1761005192 TuxCare security update for net.minidev (1 CVE)

TuxCare rebuilt 2 net.minidev packages to address 1 CVE. Fixed in 1.3.2-tuxcare.1...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

Security update for kubevirt

This update for kubevirt fixes the following issues: Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: CVE-2026-39821 bsc1266575: the previous entry claimed this fixed by the golang.org/x/net v0.55.0...

SUSE-SU-2026:23052-1 Security update for helm

This update for helm fixes the following issues Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...