CVE-2026-83602

The open-source observability tool Netdata (versions 2.0.0 through 2.11.0 ) is vulnerable to an unauthenticated remote bypass of IP restrictions. The root cause is the registration of the /api/v3/settings endpoint in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA...

CVE-2026-44236

A flaw was found in rabbitmq-c. A malicious AMQP Advanced Message Queuing Protocol server or an on-path attacker can send an undersized frame size during the login handshake. This can lead to a heap buffer overflow, causing memory corruption and potentially a denial of service. Code execution is...

UBUNTU-CVE-2026-86805

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...

CVE-2026-44235

A flaw was found in rabbitmq-c, a C-language AMQP Advanced Message Queuing Protocol client library. A malicious AMQP server or an on-path attacker can send an undersized HEADER or METHOD frame during client login, leading to an unsigned sizet underflow. This underflow causes an out-of-bounds read...

CVE-2026-95619

A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability...

`stack-graphs` C API exports are safe `extern "C"` functions

stackgraphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them. sgstackgraphfree frees the pointer with Box::fromraw. sgstackgraphfreestd::ptr::nullmut is immediate...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399...

[SECURITY] Fedora 45 Update: chromaprint-1.6.1-2.fc45

Chromaprint library is the core component of the AcoustID project. It's a client-side library that implements a custom algorithm for extracting fingerprints from raw audio sources. The library exposes a simple C API. The documentation for the C API can be found in the main header file. License fo...

CVE-2026-94574: Undefined Security Weakness

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

CVE-2026-89282: Incorrect Permission Assignment for Critical Resource

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:, which inherits write access for Authenticated Users...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: c-ares (UTSA-2023-002303)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002303 advisory. c-ares is an asynchronous resolver library. aresinetnetpton is vulnerable to a buffer underflow for certain ipv6 addresses, in particular 0::00:00:00/2 was found to...

CVE-2026-83602: Improper Access Control

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

CVE-2026-88345

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex dereferences the input pointer after it has reached the end of the buffer. A specially crafted...

ROS-20260922-73-0051

The vulnerability of the opmap2430probe function in the drivers/usb/musb/omap2430.c driver for Linux USB device drivers is related to the dereferencing of a pointer with an expired lifetime. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: c-ares (UTSA-2023-002302)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002302 advisory. c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. Th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: protobuf-c (UTSA-2023-001305)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001305 advisory. protobuf-c before 1.4.1 has an unsigned integer overflow in parserequiredmember. Tenable has extracted the preceding description block directly from the Unity Linux...

CVE-2026-95818: Stack-based Buffer Overflow

A stack-based buffer overflow in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid ATSECURE programs. When such a program's DTRPATH or DTRUNPATH begins with $ORIGIN and is followed by NUL or '/' t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: librabbitmq (UTSA-2023-002168)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002168 advisory. An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

Oracle Linux 9 : curl (ELSA-2026-69126)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69126 advisory. - add sasl service name to connection reuse checks CVE-2026-8458 Tenable has extracted the preceding description block directly from the Oracle Linux...