ROS-20260925-73-0102

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

Linux Distros Unpatched Vulnerability : CVE-2026-67225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated...

Linux Distros Unpatched Vulnerability : CVE-2026-98157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the...

Linux Distros Unpatched Vulnerability : CVE-2026-97927

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ufs: create the root dentry after loading cylinder metadata ufsfillsuper installed sb-sroot before it loaded the cylinder group structures for a writable mount...

Linux Distros Unpatched Vulnerability : CVE-2026-97982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of...

openSUSE 16 Security Update : distribution (openSUSE-SU-2026:21898-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21898-1 advisory. - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the...

CVE-2026-17545: Improper Handling of Windows Device Names

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-66073: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

CVE-2026-97601: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpannewlink TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink checks only the device type before...

CVE-2026-91765: Uncontrolled Recursion

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

CVE-2026-98085: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

Linux Distros Unpatched Vulnerability : CVE-2026-59980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input...

openSUSE 16 Security Update : zstd-jni (openSUSE-SU-2026:21902-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21902-1 advisory. - CVE-2026-87823: denial of Service or Information Disclosure via out-of-bounds read bsc1279953. - CVE-2026-87824: denial of Service DoS via...

CVE-2026-67409: Unchecked Return Value

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

Linux Distros Unpatched Vulnerability : CVE-2026-97526

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e paicrypto/CRYPTOALL/ -- ' crashes the kernel when CPUs are hotplug added during that run...

Linux Distros Unpatched Vulnerability : CVE-2026-98087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps...

Linux Distros Unpatched Vulnerability : CVE-2026-97598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash...

Linux Distros Unpatched Vulnerability : CVE-2026-98075

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is...

Linux Distros Unpatched Vulnerability : CVE-2026-96746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the...

Linux Distros Unpatched Vulnerability : CVE-2026-19888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to...