RHEL 8 : kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 (RHSA-2026:62558)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62558 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module ...

PT-2026-85374

Name of the Vulnerable Software and Affected Versions IXON VPN Client versions prior to 1.4.7 Description An improper CRLF Carriage Return Line Feed sequence neutralization flaw allows unauthenticated local attackers to execute commands with root or SYSTEM privileges. The issue exists in a...

PT-2026-85275

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

PT-2026-85074

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the...

Linux Distros Unpatched Vulnerability : CVE-2026-84379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates...

Linux Distros Unpatched Vulnerability : CVE-2026-84382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip,...

Linux SMB Client Buffer Overflow

The vulnerability of the cifsoplockbreak function in the fs/smb/client/file.c module of the SMB client support library in Linux operating systems is related to the pointer manipulation. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and...

Fedora 44 : valkey (2026-f6cb88e85a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f6cb88e85a advisory. Valkey 9.0.6 - Released Tue 01 September 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible...

Linux Distros Unpatched Vulnerability : CVE-2026-84372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster an...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-105549)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105549 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parsedfsreferrals validates that the response...

Oracle Linux 10 : ELSA-2026-61241-0: / pipewire (ELSA-2026-612410)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-612410 advisory. 1.4.11-1.1 - Fix CVE-2026-14324: limit RTSP Content-Length and check allocation in RAOP client Resolves: RHEL-249305 Tenable has extracted the preceding...

Oracle Linux 10 : ELSA-2026-62577-0: / go-fdo-client (ELSA-2026-625770)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-625770 advisory. 1.0.0-7 - Rebuild go-fdo-client against updated golang 1.0.0-6 - Rebuild go-fdo-client against updated golang 1.0.0-5 - Rebuild against updated gola...

RockyLinux 10 : go-fdo-client (RLSA-2026:62577)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62577 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 encoding/asn1: golang: Go...

EUVD-2026-63649

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends...

GHSA-9468-V6MJ-FPPW Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Vulnerability Details File: internal/client/handler.go OnClientConnecting, internal/proxy/http.go requestHeaders, internal/proxy/grpc.go requestMetadata, internal/unigrpc/grpc.go Consume Line: handler.go:389,548-552 e.Headers - SetEmulatedHeadersToContext, http.go:131-165 requestHeaders,...

Hurl: Cookies in Cookies section leak when redirecting to a different host

The Bug Hurl = 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the Header/headers area 2. In a dedicated Cookies section parsed into RequestSpec.cookies When following a redirect to a different host, Hurl correctly strips security-sensitive data Authorization...

CVE-2026-84841

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...

CVE-2026-84379

A flaw was found in HTTPX2, a Python HTTP client. A remote attacker could exploit this vulnerability by sending specially crafted multipart/form-data requests. The FileField.renderheaders function fails to validate Content-Type values and custom headers, allowing the injection of Carriage Return ...

CVE-2026-84382

A flaw was found in httpx2, a Python HTTP client. The content decoders in httpx2 fully inflate compressed network chunks such as gzip, deflate, br, or zstd before yielding bounded pieces to the application. This can lead to a small compressed chunk expanding significantly in memory, for example, ...

EUVD-2026-70255

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for...