kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target subsystem. This vulnerability involves a buffer overread and a double-free error when processing iSCSI Text commands. A remote attacker could exploit these issues by sending specially crafted network...

Linux Distros Unpatched Vulnerability : CVE-2026-77301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory...

TencentOS Server 4: storm (TSSA-2026:1037)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1037 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

FreeBSD : mailpit -- Multi-frame animation bypass of thumbnail pixel budget (c1980e14-b424-11f1-bd9f-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1980e14-b424-11f1-bd9f-10ffe07f9334 advisory. Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 Thumbnail generation decodes...

ROS-20260923-73-0017

The vulnerability of the sctpprocessstrresetresp function in the net/sctp/stream.c module of the Linux operating system’s SCTP protocol implementation is related to the dereferencing of a pointer with an expired validity period. Exploiting this vulnerability could allow a remote attacker to cause...

AlmaLinux 9 : runc (ALSA-2026:70191)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:70191 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding description blo...

Linux Distros Unpatched Vulnerability : CVE-2026-83600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ullencoded passes to...

CVE-2026-67235: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

CVE-2026-95843: Improper Input Validation

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

TencentOS Server 4: storm (TSSA-2026:1032)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1032 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Wireshark 4.6.x < 4.6.7 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.6.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.7 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profile import...

Linux Distros Unpatched Vulnerability : CVE-2026-89407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates stringified numbers with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?,...

CVE-2026-67238: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...

Apache Tomcat 11.0.0.M1 < 11.0.26 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.26. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.26security-11 advisory. - CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled...

Wireshark 4.4.x < 4.4.17 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.4.17. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.17 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profile impo...

Wireshark 4.6.x < 4.6.9 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.6.9. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.9 advisory. - C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-77423: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-95842: Uncaught Exception

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:4286-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4286-1 advisory. - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 - CVE-2026-56855:...

Wireshark 4.4.x < 4.4.16 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.16 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profile impo...