SUSE SLES12 Security Update : gnutls (SUSE-SU-2026:2923-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2923-1 advisory. This update for gnutls fixes the following issues - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints...

JLSEC-2026-755 X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted...

JLSEC-2026-685 In function MatchDomainName(), input param str is treated as a NULL terminated string despite being...

In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...

JLSEC-2026-740 A 1-byte stack buffer over-read was identified in the MatchDomainName function (`src/internal.c`)...

A 1-byte stack buffer over-read was identified in the MatchDomainName function src/internal.c during wildcard hostname validation when the LEFTMOSTWILDCARDONLY flag is active. If a wildcard exhausts the entire hostname string, the function reads one byte past the buffer without a bounds check,...

CVE-2026-46644

Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process does not enforce the UTS 46...

MAL-2026-10605 Malicious code in @radivi-ui/react-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e92ae03eb6adb090fb832665431984cccef31039bb920e3850535f4defe610 @radivi-ui/react-dialog is a typosquat of @radix-ui/react-dialog whose main entry index.js is a self-executing IIFE that runs whoami and hostname via...

CVE-2026-49169

Use after free in DNS Server allows an authorized attacker to execute code over a network...

CVE-2026-15428

An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with...

CVE-2026-50487 Windows DNS Client Elevation of Privilege Vulnerability

...

CVE-2026-50487 Windows DNS Client Elevation of Privilege Vulnerability

...

CVE-2026-50495 DNS Client Tampering Vulnerability

...

CVE-2026-50495 DNS Client Tampering Vulnerability

...

CVE-2026-50495

CVE-2026-50495 is a Windows DNS vulnerability described as improper access control that could allow an authorized local attacker to tamper DNS-related data. Multiple connected sources (NVD entry and MSRC update guidance) confirm this as a locally exploitable issue with a baseline CVSS v3.1 score ...

CVE-2026-50465

CVE-2026-50465 is a Windows DNS Client tampering vulnerability caused by improper access control that can be exploited locally by an authorized attacker. Connected sources confirm Windows DNS is affected (CVE-2026-50465 listed under Windows DNS with data manipulation; MSRC update guidance). The C...

CVE-2026-50426 Windows DNS Server Remote Code Execution Vulnerability

...

CVE-2026-50295 Windows Zero Trust DNS Security Feature Bypass Vulnerability

...

CVE-2026-50295 Windows Zero Trust DNS Security Feature Bypass Vulnerability

...

CVE-2026-49174 DNS Client Tampering Vulnerability

...

CVE-2026-49174

CVE-2026-49174 describes a vulnerability in Microsoft Windows DNS where missing authentication for a critical function could allow a locally authorized attacker to tamper with DNS behavior. The NVD entry notes a CVSS v3.1 base score of 6.1 (Medium) with a LOCAL attack vector, LOW attack complexit...

CVE-2026-49175

CVE-2026-49175 is a Windows DNS Client vulnerability described as a heap-based buffer overflow that allows an authorized attacker to achieve local privilege escalation. The issue affects the Windows DNS client and is characterized by a LOCAL attack vector with low attack complexity and the need f...