Fedora 44 : rpki-client (2026-fb17adc9de)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fb17adc9de advisory. rpki-client 9.9 - Introduce a backoff retry mechanism for non-functional CAs, eventually settling on retrying broken CAs only once per day. Backoff helps...

Amazon Linux 2 : libXfont2, --advisory ALAS2-2026-3889 (ALAS-2026-3889)

The version of libXfont2 installed on the remote host is prior to 2.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3889 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

OESA-2026-3567 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...

OESA-2026-3566 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...

OESA-2026-3565 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...

PT-2026-84854

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: An unknown vulnerability exists in QEMU, with no detailed description available at this time.CVE-2026-15264 CVE-2026-16457 is a security vulnerability in QEMU. The specific details of thi...

OPENSUSE-SU-2026:11647-1 httpcomponents-client-4.5.14-2.1 on GA media

These are all security issues fixed in the httpcomponents-client-4.5.14-2.1 package on the GA media of openSUSE Tumbleweed...

4591-libs (>=0.0.1, <=0.2.0), @0x0bit/sails-hook-redis (>=0.1.1, <=0.1.2) +3739 more potentially affected by CVE-2026-82562 via qs (>=6.14.2, <=6.15.3)

qs NPM version =6.14.2, =0.0.1, =0.1.1, =0.1.1, =0.0.1-alpha.29, =0.1.6-alpha.11, =0.0.1-alpha.20, =0.0.0-alpha.119, =1.2.1-dev.3, =1.0.5, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =1.0.14 and more Source cves: CVE-2026-82562 Source advisory: MEND:CVE-2026-82562...

CVE-2026-82463

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks...

CVE-2026-82462 pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulti...

Improper Certificate Validation

org.mariadb.jdbc:mariadb-java-client is vulnerable to Improper Certificate Validation. The vulnerability is due to improper certificate fingerprint validation during the initial TLS handshake, which allows an active man-in-the-middle attacker or malicious server to present a self-signed certifica...

Malicious Package

Overview analytics-web-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ux-metrics-client-interaction-subscriber is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

Malicious Package

Overview grafeno-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ir-annuities-client-authentication-module is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

EUVD-2026-67934

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

PT-2026-89178

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF attack when the AIOHTTP CLIENT ALLOW REDIRECTS variable is set to true. The platform fails to reapply the WEB FETCH FILTE...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2024-002980)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-002980 advisory. An out-of-bounds memory read flaw was found in receiveencryptedstandard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue...

Linux Distros Unpatched Vulnerability : CVE-2026-55584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts...