Linux Distros Unpatched Vulnerability : CVE-2026-72101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix leaking uninitialized kernel memory If hash size is less than device's tup...

AlmaLinux 10 : libssh (ALSA-2026:55855)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised chann...

CVE-2026-52735: Incorrect Provision of Specified Functionality

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes. In zebra-script/src/lib.rs, p2shinputsigopcount used the...

PT-2026-77664

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware component: Security and Authentication. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Report...

PT-2026-77417

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can...

PT-2026-77653

Name of the Vulnerable Software and Affected Versions Oracle Reports Developer version 12.2.1.19.0 Description A security and authentication issue in Oracle Reports Developer allows a low privileged attacker with network access via HTTP to compromise the system. Although the flaw resides in Oracl...

PT-2026-77921

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Order Management versions 12.2.3 through 12.2.15 Description An issue exists in the Product Diagnostic Tools component of Oracle Order Management. A low privileged attacker with network access via HTTP can...

PT-2026-78104

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.25.0.000 Description A security issue in the Security component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system...

CVE-2026-72124

A flaw was found in the Linux kernel's Controller Area Network CAN ISO-TP transport protocol module. A race condition in the transmit TX state machine allows for unsynchronized state transitions. This can lead to a situation where a frame or timer callback operates on an outdated state, resulting...

CVE-2026-72108

A flaw was found in the Linux kernel's device-mapper dm thin metadata component. When operations involving metadata snapshots, such as reserving or releasing a snapshot, encounter a commit failure, the system can write an inconsistent 'heldroot' to disk. This can lead to metadata corruption withi...

CVE-2026-72101

A flaw was found in dm-integrity, a component of the Linux kernel. This vulnerability occurs when the hash size is less than the device's tuple size, and dm-integrity fails to properly zero out the remaining memory space. This oversight can lead to the leaking of uninitialized kernel memory,...

unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes

A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibli...

libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...

CVE-2026-72064

A flaw was found in the Linux kernel's mana network driver. When the driver allocates receive RX buffers from page pool fragments, it fails to perform an explicit synchronization for the CPU. This oversight can lead to data integrity issues or system instability on systems configured to require...

Improper Verification of Cryptographic Signature

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

SUSE CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

JLSEC-2026-1335

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and...

CVE-2026-74901

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without...

PYSEC-2026-3773

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without...

PYSEC-2026-3766

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...