[SECURITY] Fedora 45 Update: gnome-connections-51.0-1.fc45

Connections is a remote desktop client for the GNOME desktop environment...

SUSE CVE-2025-14181

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

PT-2026-103004

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions prior to 41.0 Description Improper input validation in the signaling implementation allows a remote attacker to trigger a software abort, leading to a denial of service. This issue can be exploited by accessing a gatewa...

PT-2026-105768

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

Linux Distros Unpatched Vulnerability : CVE-2026-97687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs,...

CentOS Linux 7 [TuxCare] Security Update: libXfont2 / libXfont2-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1787393547)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1787393547 advisory. - A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers abl...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1790065872)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1790065872 advisory. - FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR...

PT-2026-105647

These are all security issues fixed in the yast2-auth-client-5.0.5-1.1 package on the GA media of openSUSE Tumbleweed...

Helol Tunnel: Covert Channel Exploitation of TLS Extensibility and Privacy Features

Covert channels exploiting network protocols for data exfiltration and command-and-control C2 are integral parts of modern cyberattacks. In search of a significant covert channel within the fabric of the Internet, we targeted the combinatorial properties of the Client Hello CHLO packets in the...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776763201)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776763201 advisory. - A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs...

AlmaLinux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc (ALMALINUX9.6:CLSA-2026:1768930687)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768930687 advisory. - SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...

CVE-2026-103227: Buffer Copy without Checking Size of Input

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-97078: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Client Invoicing by Sprout Invoices = 20.8.17 versions...

CVE-2026-10739: Relative Path Traversal

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...

CVE-2026-76992: Allocation of Resources Without Limits or Throttling

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a...

ROS-20260930-73-0045

The vulnerability of the nfs4ffallocdeviceidnode function in the fs/nfs/flexfilelayout/flexfilelayoutdev.c module, which is part of the NFS client support in Linux operating systems, is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause servic...

PT-2026-103119

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a...

PT-2026-103124

Name of the Vulnerable Software and Affected Versions Cato Networks SDP Client for Windows versions prior to 6.12.6 Description A local privilege escalation issue exists due to improper validation of a client-supplied Security Identifier SID over a local Inter-Process Communication IPC named pipe...

PT-2026-103255

Name of the Vulnerable Software and Affected Versions OAuth Single Sign On – SSO OAuth Client versions prior to 7.1.3 Description An authentication bypass exists in the OAuth Single Sign On – SSO OAuth Client plugin that is reachable pre-login. This allows unauthenticated attackers to forge a...

PT-2026-103284

🚨 CVE-2026-103227 A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf dash resolve url of the file src/media tools/dash client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely...