Linux Distros Unpatched Vulnerability : CVE-2026-64091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. ...

RHEL 8 : nodejs:22 (RHSA-2026:41947)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41947 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-1952)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1952 advisory. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected...

CVE-2026-63834

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: restrict number of unacked list entries When the unackedlist is unbound, an attacker could send messages with small lengths and appropriated seqno + gaps to force the receiver to allocate more and more...

Linux Distros Unpatched Vulnerability : CVE-2026-47183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger...

CVE-2026-54463

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set, and a server or client can send an...

DEBIAN-CVE-2026-54463

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set, and a server or client can send an...

EUVD-2026-45310

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set, and a server or client can send an...

CVE-2026-54463

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set, and a server or client can send an...

CVE-2026-54463

The CVE-2026-54463 issue affects the websocket-driver WebSocket protocol handler (prior to version 0.8.1). The root cause is a length header in draft WebSocket protocol frames that can encode an arbitrarily large integer, allowing a peer to send an indefinite sequence of 0x80+ bytes that are pars...

DEBIAN-CVE-2026-47183

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...

CVE-2026-41851

A flaw was found in Spring Framework. Applications that accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack. This occurs if the evaluation of a SpEL expression triggers unbounded cache growth, consuming excessive resources and makin...

CVE-2026-47183: Uncontrolled Resource Consumption

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...

SUSE CVE-2026-47736

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...

CVE-2026-8609

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate user...

Amazon Linux 2023 : libde265, libde265-devel (ALAS2023-2026-1918)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1918 advisory. libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a crafted H.265 bitstream can cause an out-of-bounds array write in...

F5 Networks BIG-IP : BIG-IP HTTP/2 vulnerability (K000162231)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.4 / 17.5.1.8 / 21.0.0.3 / 21.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000162231 advisory. When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an...

Linux Distros Unpatched Vulnerability : CVE-2026-47736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes int...

MGASA-2026-0253 Updated openssl packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion. CVE-2026-7383 Out-of-Bounds Read in CMS Password-Based Decryption. CVE-2026-9076 Heap Buffer Over-read in ASN.1 Content Parsing. CVE-2026-34180 PKCS12 Files with PBMAC1 Are...

CVE-2026-59762

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote,...