openSUSE 16 Security Update : python-mistune (openSUSE-SU-2026:21339-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21339-1 advisory. This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py...

SUSE SLES12 Security Update : tiff (SUSE-SU-2026:3027-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3027-1 advisory. This update for tiff fixes the following issues - CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF...

PT-2026-60689

Name of the Vulnerable Software and Affected Versions Envoy Gateway affected versions not specified Description An issue exists during OCI layer extraction where the system allocates memory using makebyte, h.Size based on the size declared in a tar header. Because the LimitReader only bounds the...

expat security update

2.7.3-57 - expat: backport CVE-2026-45186 fix attribute collision check DoS 2.7.3-56 - Rebase to 2.7.3 and add VCS tag Thu Jun 05 2025 [email protected] - https://issues.redhat.com/browse/RHELMISC-13073 Fri Mar 28 2025 Tomas Korbar - Fix behavior change caused by fix for CVE-2024-8176 Fri Mar 1...

AlmaLinux 8 : container-tools:rhel8 (ALSA-2026:38504)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:38504 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 golang.org/x/crypto/ssh: golang:...

RockyLinux 8 : nodejs:24 (RLSA-2026:39868)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:39868 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

SUSE SLES12: ImageMagick-config-6-SUSE / ImageMagick-config-6-upstream / etc (SUSE-SU-2026:3024-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3024-1 advisory. This update for ImageMagick fixes the following issues - CVE-2026-42050: stack buffer overflow in XTileImage bsc1265048. - CVE-2026-42326:...

actix-prost (>=0.1.0, <=0.3.2), adns-server (>=0.1.0, <=0.3.0) +759 more potentially affected by unknown CVE via serde_with (>=3.8.1, <=3.14.1)

serdewith CARGO version =3.8.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =0.1.1, =0.1.1, =0.1.5, =0.1.0, =0.1.0, =0.10.1 - attest-prove 0.0.1 - attest-types 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7GCF-G7XR-8HXJ...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3506 more potentially affected by CVE-2026-54490 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54490 Source advisory: OSV:GHSA-MP7J-QC5W-4988...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3506 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: SNYK:JS-WEBSOCKETDRIVER-17987994...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3506 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: OSV:GHSA-XV26-6W52-CPH6...

CVE-2026-40955

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client...

CVE-2026-40958

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +49375 more potentially affected by CVE-2026-62389 via ws (>=8.0.0, <=8.21.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0-rc.7, =0.1.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-62389 Source advisory: SNYK:JS-WS-17988732...

perl-XML-LibXML security update

An update is available for perl-XML-LibXML. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This module implements a Perl interface to the GNOME libxml2 library...

RLSA-2026:39553 Important: perl-XML-LibXML security update

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fixes:...

CVE-2026-62389

...

CVE-2026-52865

When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. Impact: The NGINX Ingress Controller control plane...

GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering

A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...

nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()

A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the subtle.encrypt function that is a multiple of 2 gigabytes GiB. This could lead to a denial of service DoS by crashing the Node.js process...