vuls

Vuls: VULnerability Scanner Vulnerability scanner for Linux/FreeBSD, agent-less, written in Go. Twitter: @vulsen...

slot2

slot2 slot2: un bootkit UEFI GRUB2 a due stadi che rende persistente un impianto di rete pre-OS su Amazon Linux 2023 su AWS EC2 UEFI x8664. di cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/slot2 Sommario slot2 è un bootkit per Amazon Linux 2023 su EC2. Il firmware UEFI d...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2053 advisory. FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client rand...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-2048)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2048 advisory. Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47303 Improper verification of cryptographic...

Amazon Linux 2 : perl-Date-Manip, --advisory ALAS2-2026-3856 (ALAS-2026-3856)

The version of perl-Date-Manip installed on the remote host is prior to 6.41-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3856 advisory. Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeri...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-138 (ALASDOCKER-2026-138)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-138 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extract...

Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-117 (ALASNITRO-ENCLAVES-2026-117)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-117 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable h...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-2060)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2060 advisory. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attack...

Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-116 (ALASNITRO-ENCLAVES-2026-116)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-116 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has...

Amazon Linux 2023 : docker (ALAS2023-2026-2062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2062 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2058)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2058 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count CVE-2026-53392 In the Linux kernel, the following vulnerability has be...

Important: docker

Issue Overview: A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Affected Packages: docker Issue Correction: Run dnf update docker --releasever 2023.12.20260817 or dnf update --advisory ALAS2023-2026-2062 --releasever 2023.12.20260817 to...

Important: pipewire

Issue Overview: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return. CVE-2026-14324 Multiple unbounded alloca calls in the PulseAudio protocol server. CVE-2026-14330 A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker t...

Important: acl

Issue Overview: A flaw was found in the acl component, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or wri...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1996)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1996 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2 : python, --advisory ALAS2-2026-3845 (ALAS-2026-3845)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3845 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1999)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1999 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3839 (ALAS-2026-3839)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3839 advisory. Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

Amazon Linux 2023 : python3-pyasn1, python3-pyasn1-modules (ALAS2023-2026-2000)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2000 advisory. pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound ...