PT-2026-96575

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache disposal UAF by inlining dispose state into nfsd net nfsd file dispose list delayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of...

PT-2026-89827

Name of the Vulnerable Software and Affected Versions Net-SNMP versions prior to 5.9.5.3 Description The SMUX module contains a flaw where the smux accept function performs an unauthenticated blocking read without a timeout on newly accepted connections. A remote unauthenticated client can connec...

Security Update for Microsoft ASP.NET Core (September 2026)

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by a denial of service vulnerability as referenced in the vendor advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-report...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107329 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful...

Microsoft .NET Core SDK Information Disclosure Vulnerability

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by an information disclosure vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Linux Distros Unpatched Vulnerability : CVE-2026-89147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smuxaccept performs an unauthenticated blocking read without timeou...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107274)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107274 advisory. In the Linux kernel, the following vulnerability has been resolved: 9p/net: fix improper handling of bogus negative read/write replies In p9clientwrite and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107311)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107311 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error...

PT-2026-90398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component. The function nfsd file dispose list delayed defers fput to nfsd service threads using a per-net freeme queue stored in a separately...

PT-2026-90383

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the filecache of the nfsd component. The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd file from the rhashtable and call nfsd file dispo...

SUSE CVE-2026-86564

A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

K000163284: Linux kernel vulnerability CVE-2026-53232

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfpbusdelupstream in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling...

GHSA-9MR8-PWPW-3J2W vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-M93F-WJ8C-RP8P vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

USN-8740-1 dotnet8, dotnet10 vulnerabilities

Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. CVE-2026-58649 Rajesh Chada discovered that the .NET watch AspireServerService improperl...

USN-8740-1: .NET vulnerabilities

Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. CVE-2026-58649 Rajesh Chada discovered that the .NET watch AspireServerService improperl...