Rocky Linux 9 [CIQ] Security Update: ncurses / ncurses-base / ncurses-c++-libs / etc (crlsa-2025_12876)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202512876 advisory. ncurses: segfaulting OOB read CVE-2022-29458 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has no...

RLSA-2026:72467 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: ext4: fix e4b bitmap inconsistency reports...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1771241609)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1771241609 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in sesintfremove A fix for: BUG:...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc (ALMALINUX9.2:CLSA-2025:1748001706)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1748001706 advisory. - GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the...

AlmaLinux 9.2 [TuxCare] Security Update: opensc (ALMALINUX9.2:CLSA-2025:1760022476)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760022476 advisory. - A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardoshaveverifyrcpackage. The attack...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

EUVD-2026-89201

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102718

The NetX Duo SNMP addon contains a vulnerability in the _nx_snmp_utility_object_id_get function. The component fails to validate the claimed OID data length against the actual buffer size when using BER multibyte length encoding . A remote attacker can send a crafted SNMP packet with an OID lengt...

EUVD-2026-89181

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102718

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

CVE-2026-102712

On the first DTLS ClientHello, the parser copies a device-claimed sessionid length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim in...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

CVE-2026-102711

The ThreadX loadable-module loader contains two issues triggered when a device loads an attacker-controlled module via the _txm_module_manager_memory_load or _txm_module_manager_in_place_load APIs. Because these APIs accept only a base pointer without an image length, fields in TXM_MODULE_PREAMBL...

CVE-2026-102711

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

EUVD-2026-89174

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txmmodulemanagermemoryload / txmmodulemanagerinplaceload — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXMMODULEPREAMBLE is fully...

PT-2026-102760

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description During the first DTLS ClientHello, the parser copies a device-claimed session id length and validates the ciphersuite-list length against the total record length...

PT-2026-102759

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via txm module manager memory load / txm module manager in place load — APIs that take ONLY a base pointer, no image length, so every size/offset field in TXM MODULE PREAMBLE is full...

CVE-2026-102712: Out-of-bounds Read

On the first DTLS ClientHello, the parser copies a device-claimed sessionid length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim in...