Fedora 45 : bind (2026-0adbf9c133)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0adbf9c133 advisory. Fixes multiple CVEs, without a rebase to newer version - Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 - Key Record using PRIVATEDNS...

openSUSE 16: libzypp / libzypp-devel / zypper / zypper-aptitude / zypper-log / etc (openSUSE-SU-2026:21808-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21808-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. Non security issues fixed: - Eco...

CVE-2026-79362

Certain Woltlab products are vulnerable to Remote Code Execution (RCE) via Cache Poisoning in the WCF component. The vulnerability affects versions WCF >= 6.1.0 until = 6.2.0 until

PT-2026-96497

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

PT-2026-90476

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management swap system where a hibernation slot is incorrectly freed while it is still present in the swap cache. This occurs because the swap free...

CVE-2026-89263: Missing Authentication for Critical Function

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

PT-2026-89902

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-89487: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

PT-2026-90203

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the openvswitch module where the queue userspace packet function incorrectly handles packet socket buffers skb. When an error occurs, the do execute actions function...

PT-2026-96555

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache cleaner before destroying a cache detail sunrpc destroy cache detail only cancels the global cache cleaner delayed work when cache list is empty. During per-netns teardown cache list is never empty...

PT-2026-90264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SUNRPC component. The function sunrpc destroy cache detail only cancels the global cache cleaner delayed work when the cache list is empty. During...

CVE-2026-79362: Improper Control of Generation of Code

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...

PT-2026-96068

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

CVE-2026-89092: Memory Allocation with Excessive Size Value

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted...

PT-2026-90086

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache component where the get cache segment function scans the segment map up to the physical device segment count, while cache segs init only initializes segments...

PT-2026-90088

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the dm-pcache module where the tail-kset read in the cache replay function, the writeback worker, and the GC worker bounds its length by the raw segment size PCACHE SEG SI...

PT-2026-90290

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm array component where array block headers are not properly validated during read operations. The array block check function only validates the block number and...

PT-2026-96553

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf validity cache sechdrs, section sizes and offsets are validated, unless the section type is SHT NULL or SHT NOBITS. Later, elf validity cache secstrings and elf validity cache...

CVE-2026-89639: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifsinvalidatecache in cifsdotruncate for OTRUNC cifsdotruncate is invoked from cifsopen without irwsem, so it cannot use cifsresizefilelocked to perform a proper fscache cookie resize. Instead, add cifsinvalidatecache...

EUVD-2026-76188

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF = 6.1.0 until = 6.2.0 until 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject...