Elasticsearch 9.2.x / 9.2.8 / 9.3.x / 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-190)

The version of Elasticsearch installed on the remote host is prior to 9.4.8 or 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-190 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an...

Elasticsearch 8.12.x < 8.19.23 / 9.3.x / 9.3.8 / 9.4.0 < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-195)

The version of Elasticsearch installed on the remote host is prior to 8.19.23, 9.4.8, or 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-195 advisory. - Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via...

PT-2026-109168

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

EUVD-2026-95916

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format CPF handling logic. This allows a remote attacker to cause a denial of service...

AlmaLinux 9 : freerdp (ALSA-2026:76755)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76755 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

Linux Distros Unpatched Vulnerability : CVE-2026-107678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees...

Linux Distros Unpatched Vulnerability : CVE-2026-107634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in getdataset and getnextdatum that never validate dataset and datum sizes against the...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22035-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22035-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs...

Linux Distros Unpatched Vulnerability : CVE-2026-78669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236:...

Linux Distros Unpatched Vulnerability : CVE-2026-107696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit...

Cisco NX-OS Software NX-API RCE (cisco-sa-napi-rce-r2shwu2j)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS...

Linux Distros Unpatched Vulnerability : CVE-2026-107386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before...

Elastic Agent 8.19.13 < 8.19.22 / 9.2.7 <= 9.2.8 / 9.3.x <= 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-194)

The version of Elastic Agent / Elastic Endpoint installed on the remote Windows host is 8.19.13 through 8.19.21, or 9.2.7 through 9.2.8, or 9.3.x through 9.3.8, or 9.4.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a denial of service vulnerability as referenced in the...

Linux Distros Unpatched Vulnerability : CVE-2026-107655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an...

Linux Distros Unpatched Vulnerability : CVE-2026-107635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dislocker through 0.7.3 contains an integer underflow vulnerability in getvmk and getfvek that allows attackers to trigger out-of-bounds heap reads via crafted...

Cisco License (Smart Software Manager) On-Prem Multiple Vulnerabilities (cisco-sa-ssm-access-nttb2dhE)

According to its self-reported version, Cisco License On-Prem formerly Cisco Smart Software Manager On-Prem is affected by multiple vulnerabilities, including: - A vulnerability in the web-based management interface of Cisco License On-Prem could allow an unauthenticated, remote attacker to gain...

Linux Distros Unpatched Vulnerability : CVE-2026-107888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs when a job marked job-held-on-create refers to a temporary printer that ha...

AlmaLinux 10 : python3.14 (ALSA-2026:77018)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77018 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

Rocky Linux 8 [CIQ] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc Multiple Vulnerabilities (crlsa-2026_76777)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676777 advisory. glibc: Process abort due to invalid memory in wordexp CVE-2026-6368 glibc: Denial of Service via stack exhaustion during tilde expansion CVE-2026-6791...