CVE-2026-89481: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

PT-2026-90242

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where the RPC/RDMA Read chunk position field, provided by a remote client, is not properly validated against the received inline body length. The...

PT-2026-89771

Name of the Vulnerable Software and Affected Versions Qt NFC affected versions not specified Description An out-of-bounds read occurs during the parsing of language code lengths. A physically proximate attacker can exploit this by using a crafted NFC tag to trigger a denial of service or limited...

AlmaLinux 10 : postgresql16-postgis (ALSA-2026:65899)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65899 advisory. postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer CVE-2026-73515 Tenable has extracted the preceding description block...

Oracle Linux 9 : ELSA-2026-66542-0: / nginx (ELSA-2026-665420)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-665420 advisory. - Resolves: RHEL-212458 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 - Resolves: RHEL-219316 - nginx: NGINX: Heap buffer...

PT-2026-90240

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the ath6kl cfg80211 connect event function. The issue occurs when the function subtracts fixed Information Element IE offsets from the assoc req len and...

ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`

A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memor...

CVE-2026-16172

CVE-2026-16172 affects the Endpoint DLP (EPDLP) service of the Netskope Client , where an out-of-bounds heap read occurs due to a missing bounds check on a specially crafted message. A local standard user can trigger the flaw, causing the kernel driver handler to crash and potentially interruptin...

ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`

A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memor...

httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data()

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the ajpparsedata function attempts to read data beyond the allocated buffer size, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue potentially lea...

httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check

A flaw was found in the modproxyajp module of httpd. When processing AJP Apache JServ Protocol messages, the server fails to properly check if a string is null-terminated before attempting to read it, allowing an attacker or a malformed request to cause a heap-based buffer over-read. This issue...

SUSE CVE-2026-73324

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

SUSE CVE-2026-87576

Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-87592

Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Low...

RLSA-2026:65899 Important: postgresql16-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

postgresql16-postgis security update

An update is available for postgresql16-postgis. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostGIS adds support for geographic objects to the PostgreSQL...

RHEL 8 : freerdp (RHSA-2026:66282)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66282 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Linux Distros Unpatched Vulnerability : CVE-2026-73324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controll...

RockyLinux 10 : postgresql16-postgis (RLSA-2026:65899)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65899 advisory. postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer CVE-2026-73515 Tenable has extracted the preceding description block...

MikroTik RouterOS Missing Authentication for Critical Function Vulnerability

MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service...