Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

xmlrpc-c security update

1.51.0-11.1 - Fix HTML injection in Abyss HTTP server responses CVE-2026-15928...

RHEL 8 : xmlrpc-c (RHSA-2026:64772)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64772 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

ALSA-2026:64772 Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

Security update for c-ares

This update for c-ares fixes the following issues: CVE-2024-25629: out of bounds read in aresreadline bsc1220279. CVE-2025-31498: use-after-free in readanswers when processanswer may re-enqueue a query bsc1240955. CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free bsc1254738. CVE-2026-33630:...

SUSE-SU-2026:4021-1 Security update for c-ares

This update for c-ares fixes the following issues: - CVE-2024-25629: out of bounds read in aresreadline bsc1220279. - CVE-2025-31498: use-after-free in readanswers when processanswer may re-enqueue a query bsc1240955. - CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free bsc1254738. -...

MariaDB 3.4.0 < 3.4.10

The version of MariaDB installed on the remote host is prior to 3.4.10. It is, therefore, affected by a vulnerability as referenced in the GHSA-fmq9-qjxj-qpf7 advisory. - Impact In the Zero-Configuration SSL protocol, the MariaDB client must refuse sending clear-text password over unverified TLS...

OPENSUSE-SU-2026:21768-1 Security update for msgpack-c

This update for msgpack-c fixes the following issue: Update to release 7.0.2: - CVE-2026-72854: Integer Overflow in msgpackunpackerexpandbuffer Causes a False-Success Undersized Reservation bsc1275911...

OESA-2026-3689 aws-sdk-cpp security update

The AWS SDK for C++ provides a modern C++ version C++ 11 or later interface for Amazon Web Services AWS. This package contains the S3 component. Security Fixes: Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK...

c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP

...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

Signal-iOS v8.27.0.1843

Signal iOS Signal is a free and open source messaging app for simple private communication with friends. Also available on Android and Desktop. Questions? For troubleshooting and questions, please visit our support center or unofficial community forum. Contributing Bug Reports The best way to...

SUSE CVE-2026-55581

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowedexecutables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell...

EUVD-2026-71788

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

Linux Distros Unpatched Vulnerability : CVE-2026-86095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer...

DEBIAN-CVE-2026-86095

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

AZL-99894 CVE-2026-86095 affecting package netcdf 4.9.0-4

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

CVE-2026-86095

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

UBUNTU-CVE-2026-86095

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...