curl security update

An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...

JLSEC-2026-1340

When curl = 7.20.0 and = 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instea...

RHEL 10 : curl (RHSA-2026:55450)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55450 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Note: This advisory is applicable to Amazon Linux 2...

Unity Linux 20.1060e / 20.1070-8ae / 20.1070e Security Update: podman (UTSA-2026-099588)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099588 advisory. The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform,...

Important: iscsi-initiator-utils

Issue Overview: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

Important: isns-utils

Issue Overview: A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. CVE-2026-55995 Affected Packages: isns-utils Issue Correction: Run dnf update isns-utils...

Important: iscsi-initiator-utils

Issue Overview: An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

openSUSE 16 Security Update : open-iscsi (openSUSE-SU-2026:21580-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21580-1 advisory. Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attacke...

RHEL 9 : curl (RHSA-2026:55439)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55439 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

Security update for open-iscsi (important)

openSUSE security update: security update for open-iscsi ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21580-1 Rating: important References: bsc1268352 bsc1268353 Cross-References: CVE-2026-44943 CVE-2026-44944 CVSS scores: CVE-2026-44943 SUSE : 8...

CVE-2026-49457 QUIC has Broken TLS verification

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

EUVD-2026-58756

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

OPENSUSE-SU-2026:21580-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

SUSE-SU-2026:23157-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

SUSE-SU-2026:23235-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

SUSE-SU-2026:23223-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

EUVD-2026-58116

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service...

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

com.ongres.scram/scram-client: com.ongres.scram/scram-common: SCRAM Libraries: Authentication downgrade via TLS man-in-the-middle attack

A flaw was found in the SCRAM Salted Challenge Response Authentication Mechanism client and common libraries. An attacker performing a man-in-the-middle MITM attack on a Transport Layer Security TLS connection can silently downgrade the authentication process. This vulnerability allows the attack...