Fedora 46 : golang-x-mod (2026-f84c399b38)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f84c399b38 advisory. Automatic update for golang-x-mod-0.41.0-1.fc46. Changelog Fri Sep 25 2026 Packit - 0.41.0-1 - Update to 0.41.0 upstream release - Resolves: rhbz2486558 -...

Fedora 46 : docker-distribution (2026-a5209e3552)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5209e3552 advisory. Automatic update for docker-distribution-3.1.2-1.fc46. Changelog Thu Sep 24 2026 Bradley G Smith - 3.1.2-1 - Update to release v3.1.2 - Resolves:...

Fedora 46 : rootlesskit (2026-ec725c24c1)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ec725c24c1 advisory. Automatic update for rootlesskit-3.2.0-1.fc46. Changelog Sun Sep 20 2026 Bradley G Smith - 3.2.0-1 - Update to release v3.2.0 - Resolves: rhbz253087...

Linux Distros Unpatched Vulnerability : CVE-2026-92598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycod...

CVE-2026-92598

A flaw was found in Nodemailer. This vulnerability arises from the failure to properly apply UTS-46 normalization when encoding international domain names. A remote attacker can exploit this by crafting recipient addresses with invisible characters or compatibility mappings. This allows them to...

EUVD-2026-81298

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

DEBIAN-CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CVE-2026-92598

Nodemailer before 9.1.0 (a widely used Node.js mail library) fails to apply UTS-46 normalization when encoding international domain names. This causes the library's internal domain resolver to compute a different Punycode A-label than standards-compliant parsers. An attacker can craft recipient a...

CVE-2026-92598: Interpretation Conflict

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

Fedora 46 : ruby (2026-fbf03424ec)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbf03424ec advisory. Update resolv gem in ruby.src to resolve security issues. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 46 : rubygems (2026-c77b963cc9)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c77b963cc9 advisory. Automatic update for rubygems-4.0.20-1.fc46. Changelog Thu Sep 3 2026 Mamoru TASAKA - 4.0.20-1 - Update to RubyGems 4.0.20 - Backport ruby upstream...

Fedora 46 : stb (2026-ee846faf9d)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee846faf9d advisory. Automatic update for stb-0^20260802.2c980bb-2.fc46. Changelog Thu Sep 10 2026 Benjamin A. Beasley - 0^20260802.2c980bb-2 - Patch stbsprintf: securit...

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Summary Nodemailer resolves an international IDN / non-ASCII recipient domain to a different Punycode xn-- label than every UTS‑46‑conformant parser web browsers, the WHATWG URL Standard, Node's url.domainToASCII, Python's idna. Its address normalizer normalizeAddress in lib/mime-node/index.js us...

Fedora 46 : libcupsfilters (2026-5cce49502a)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5cce49502a advisory. Automatic update for libcupsfilters-2.2.1-3.fc46. Changelog Fri Sep 4 2026 Zdenek Dohnal - 1:2.2.1-3 - fix multiple copies not working for raster drivers...

Fedora 46 : rust-lru / rust-lru0.16 (2026-a4ab790e17)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-a4ab790e17 advisory. Update lru crate to version 0.18.4 and add a compat package for version 0.16. This fixes an obscure potential use-after-free issue: Rebuild tracker: Tenable...