CVE-2026-68744 Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

[SECURITY] [DLA 4716-1] ruby2.7 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4716-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 04, 2026 https://wiki.debian.org/LTS -...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the dns.resolveAny function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DN...

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

EUVD-2026-52523

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally...

EUVD-2026-52529

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

CVE-2026-66310

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally...

CVE-2026-65802

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the DNSConstraint::matches. An attacker can bypass name constraints by presenting a certificate with a wildcard DNS Subject Alternative Name that is improperly validated, allowing acceptance of...

RHEL 9 : thunderbird (RHSA-2026:49921)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49921 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

Important: unbound

Issue Overview: In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during RFC 8198 aggressive NSEC processing leads to cache poisoning that permits a malicious actor controlling a single delegated zone to...

sg3_utils security, bug fix, and enhancement update

1.48-7.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188123...

ALSA-2026:50141 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

ALSA-2026:50142 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

Medium: amazon-cloudwatch-agent

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

sg3_utils security, bug fix, and enhancement update

1.47-10.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188130...

PT-2026-78403

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into optio...