Amazon Linux 2 : libssh2, --advisory ALAS2-2026-3813 (ALAS-2026-3813)

The version of libssh2 installed on the remote host is prior to 1.4.3-12. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3813 advisory. libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses i...

Amazon Linux 2 : compat-libtiff3, --advisory ALAS2-2026-3822 (ALAS-2026-3822)

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3822 advisory. A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted...

Amazon Corretto Java 11.x < 11.0.32.9.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is 11 prior to 11.0.32.9.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2026-Jul-21 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

Amazon Linux 2 : perl-DBI, --advisory ALAS2-2026-3825 (ALAS-2026-3825)

The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3825 advisory. DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is...

Amazon Linux 2 : golang, --advisory ALAS2-2026-3819 (ALAS-2026-3819)

The version of golang installed on the remote host is prior to 1.25.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3819 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final...

Amazon Linux 2 : dracut, --advisory ALAS2-2026-3812 (ALAS-2026-3812)

The version of dracut installed on the remote host is prior to 033-535. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3812 advisory. A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3815 (ALAS-2026-3815)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3815 advisory. BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 PCF Font Parsing Heap Buffer Overflow...

Amazon Linux 2 : libXfont2, --advisory ALAS2-2026-3814 (ALAS-2026-3814)

The version of libXfont2 installed on the remote host is prior to 2.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3814 advisory. BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 PCF Font Parsing Heap Buffer Overflow...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3804 (ALAS-2026-3804)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3804 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iterative...

CVE-2026-46412

CVE-2026-46412 affects @beproduct/nestjs-auth versions 0.1.2–0.1.19. An attacker published malicious builds via a compromised npm publish token, deploying a Mini Shai-Hulud worm payload. The postinstall script harvested secrets (npm tokens from ~/.npmrc, GitHub PATs and OAuth tokens, Actions OIDC...

Important: kernel-livepatch-6.1.168-203.330

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.168-203.330 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.83-115.161

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.83-115.161 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.36-69.134

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.18.36-69.134 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.33-63.124

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.18.33-63.124 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.88-119.157

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.88-119.157 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-1958)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1958 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-1990)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1990 advisory. An attacker controlling an HTTP proxy or performing MITM on the plaintext pre-TLS proxy connection can trigger a single 0-byte overrun to a buffer on the stack by sending a crafted NTLM Type 2...

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1981)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1981 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...

Medium: php8.2

Issue Overview: PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.2 Issue Correction: Run dnf update php8.2 --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1958 --releasever 2023.12.20260720 to...

Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-1944)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1944 advisory. glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 GLX contextTags Use-After-Free in CommonMakeCurrent CVE-2026-56000 Tenable has extracted the preceding description block directly from the...