28727 matches found
Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2026-012)
The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2026-012 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes...
Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)
The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...
Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2026-009)
The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2LIBREOFFICE-2026-009 advisory. LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed wh...
Amazon Linux 2 : perl-YAML (ALAS-2026-3918)
The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3918 advisory. Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Tenable has extracted the preceding description blo...
Amazon Linux 2 : openssl11 (ALAS-2026-3907)
The version of openssl11 installed on the remote host is prior to 1.1.1zi-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3907 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL to buffer far...
Amazon Linux 2 : webkitgtk4 (ALAS-2026-3917)
The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3917 advisory. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.1...
Amazon Linux 2 : freerdp (ALAS-2026-3906)
The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3906 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in...
Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2026-137)
The version of ecs-service-connect-agent installed on the remote host is prior to v1.39.1.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-137 advisory. An Envoy proxy handling HTTP/3 connections can dereference a null transport socket option during t...
Amazon Linux 2 : wireshark (ALAS-2026-3905)
The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3905 advisory. C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76879 C12.22...
Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2026-119)
The version of runc installed on the remote host is prior to 1.3.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-119 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name...
Amazon Linux 2 : runc (ALASDOCKER-2026-141)
The version of runc installed on the remote host is prior to 1.3.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-141 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN...
Medium: runc
Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...
CLSA-2026-1789307500 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.3-tuxcare.2...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2023-003837)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003837 advisory. Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090126)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090126 advisory. Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window ...
SUSE CVE-2026-89560
In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...
SUSE CVE-2026-89695
In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...
openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21823-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21823-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...
Linux Distros Unpatched Vulnerability : CVE-2026-12611
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and t...
