EUVD-2026-95960

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList implementation for the EtherNet/IP GetAttributeList service. This allows a remote attacker to cause a denial of service...

Elasticsearch 8.19.x < 8.19.22 / 9.1.x / 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-189)

The version of Elasticsearch installed on the remote host is prior to 8.19.22, 9.4.8, or 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-189 advisory. - Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular...

Elasticsearch 9.2.x / 9.2.8 / 9.3.x / 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-190)

The version of Elasticsearch installed on the remote host is prior to 9.4.8 or 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-190 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an...

Linux Distros Unpatched Vulnerability : CVE-2026-107655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an...

EUVD-2026-95916

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format CPF handling logic. This allows a remote attacker to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-61801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix- style user and group database files. Versions before 0.4....

PT-2026-109168

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

AlmaLinux 10 : python3.14 (ALSA-2026:77018)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77018 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791530000)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791530000 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a differen...

AlmaLinux 9 : freerdp (ALSA-2026:76755)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76755 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

Linux Distros Unpatched Vulnerability : CVE-2026-107386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22035-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22035-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236:...

Rocky Linux 8 [CIQ] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc Multiple Vulnerabilities (crlsa-2026_76777)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676777 advisory. glibc: Process abort due to invalid memory in wordexp CVE-2026-6368 glibc: Denial of Service via stack exhaustion during tilde expansion CVE-2026-6791...

openSUSE 16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (openSUSE-SU-2026:22034-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22034-1 advisory. - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues bsc1273856. - CVE-2026-19032:...

Linux Distros Unpatched Vulnerability : CVE-2026-78669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS...

CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-105405

A flaw was found in ImageMagick. A remote attacker could exploit this vulnerability by supplying a specially crafted Magick Vector Graphics MVG image for processing. When parsed by the MVG decoder, the malformed input triggers an invalid memory free operation, crashing the application and causing...

CVE-2026-105827

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service DoS by providing a specially crafted image file in the Continuous Acquisition and Life-cycle Support CALS format. Because the CALS decoder fails to properly limit recursion depth, processing the malicious image...

CVE-2026-107708

A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center KDC to cause a Denial of Service DoS. By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate PAC, an attacker...