RXSA-2026:49857 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: Rocky Linux SIG Cloud8.10 - KVM: s390: Limit adapter indicator access to mapped page JIRA:Roc...

libXfont2 -- multiple vulnerabilities

Zhixi "Jace" Sun, independent security researcher reports: CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write...

RHEL 9 : fence-agents (RHSA-2026:50654)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50654 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

The vulnerability of the WTF web browsers Google Chrome and Microsoft Edge, which allows a hacker to trigger a service failure

The vulnerability of the WTF web browsers Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Oracle Linux 10 : kernel (ELSA-2026-49211)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49211 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-214082 CVE-2026-64530 - ksm: use range-walk function to jump over...

SUSE SLES15 Security Update : valkey (SUSE-SU-2026:3483-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3483-1 advisory. This update for valkey fixes the following issues - CVE-2026-56684: use-after-free in TLS connection handling bsc1272443. -...

RHEL 9 : fence-agents (RHSA-2026:50653)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50653 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

Important: gimp security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP APNG...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:3473-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3473-1 advisory. This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

Linux Distros Unpatched Vulnerability : CVE-2026-53500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escapi...

Linux Distros Unpatched Vulnerability : CVE-2026-64578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:3476-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3476-1 advisory. This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-1133...

The vulnerability of the WebAudio component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the WebAudio component in Google Chrome and Microsoft Edge relates to the simultaneous execution using a shared resource with improper synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

SUSE SLES12: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2026:3484-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3484-1 advisory. This update for bind fixes the following issues - CVE-2026-11622: Potential memory usage beyond configured limits bsc1271986. - CVE-2026-11721:...

Photon OS 5.0: Squid PHSA-2025-5.0-91-0690

An update of the squid package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0690. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-45100 OpenSIPS: Buffer Overflow in Base64 Encode Transformation

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...

DEBIAN-CVE-2026-47763

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

EUVD-2026-52853

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...

DEBIAN-CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...