CVE-2026-119729: Red Hat: A flaw was found in GStreamer

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

CVE-2026-119727: Red Hat: A flaw was found in GStreamer's gst-plugins-bad H.265 video parser

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding SCC extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accep...

CVE-2026-61848: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-61847: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

Important: bind9.18 security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

Traggo Server 0.8.3 GraphQL Alias Overloading Denial of Service

Traggo server version 0.8.3 contains an unauthenticated denial of service condition in its GraphQL endpoint due to alias overloading and missing request complexity and body-size limits. A proof of concept is provided. https://packetstorm.news/download/238544...

Apple LinkPresentation Out-Of-Bounds Write

Apple LinkPresentation contains an out-of-bounds write vulnerability. Processing a maliciously crafted HEIC image may result in memory corruption. https://packetstorm.news/download/238532...

Apple AVEVideoEncoder iOS 26.0 Denial of Service

Apple AVEVideoEncoder in iOS version 26.0 contains an out-of-bounds write that may cause unexpected system termination. The supplied Swift proof of concept submits a 32768 x 16384 BGRA frame to a VideoToolbox H.264 compression session to reproduce the crash. https://packetstorm.news/download/2385...

Apple LinkPresentation HEIC Out-Of-Bounds Write

Apple LinkPresentation contains an out-of-bounds write when processing a maliciously crafted image. The proof of concept generates mismatched HEIC frames and fetches the image through Open Graph link metadata. https://packetstorm.news/download/238556...

CentOS Linux 6 [TuxCare] Security Update: patch (CENTOS6:CLSA-2026:1793083677)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793083677 advisory. - A double free exists in the anotherhunk function in pch.c in GNU patch through 2.7.6. CVE-2018-6952 Note that Nessus has not tested for this...

CVE-2026-111487: qt Qt Framework: An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...

Microsoft PowerShell 7.4.x < 7.4.22 / 7.5.x < 7.5.13 / 7.6.x < 7.6.9 RCE (macOS)

The version of Microsoft PowerShell installed on the remote macOS host is 7.4.x prior to 7.4.22, 7.5.x prior to 7.5.13, or 7.6.x prior to 7.6.9. It is, therefore, affected by a remote code execution vulnerability. An out-of-bounds write in the Brotli decoder used by PowerShell 7 allows an...

Important: ImageMagick

Issue Overview: A flaw was found in ImageMagick. A stack-based buffer overflow vulnerability exists in the handling of bzip2 compressed images, where stack memory can be overwritten during decoding. By submitting a specially crafted image, an attacker can exploit this issue to cause memory...

PHP <= 8.2.35 / 8.3.x <= 8.3.36 / 8.4.x <= 8.4.27 / 8.5.x <= 8.5.12 Windows Build Brotli Buffer Overflow

The version of PHP installed on the remote Windows host is at or prior to 8.2.35, 8.3.x at or prior to 8.3.36, 8.4.x at or prior to 8.4.27, or 8.5.x at or prior to 8.5.12. It is, therefore, potentially affected by a buffer overflow vulnerability in the Brotli library bundled with the PHP Windows...

RHEL 8 : rhc (RHSA-2026:92217)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:92217 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

RHEL 9 : osbuild-composer (RHSA-2026:91587)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91587 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update (Important) (RHSA-2026:92622)

The remote Redhat Enterprise Linux 10 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:92622 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

CVE-2026-62254: libredwg: LibreDWG is a free C library to read and write DWG files

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decodeR13R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on numclasses. Manipulating...

CVE-2026-63201: CESNET netopeer2: Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol

Netopeer2 is a server for implementing network configuration management based on the NETCONF Protocol. In affected versions, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter whose text contains format specifiers. I...

Linux Distros Unpatched Vulnerability : CVE-2026-103963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in glib-networking. When establishing connections using Transport Layer Security TLS version 1.3, the client-side session cache does not limit...