SUSE-SU-2026:4077-1 Security update for wireshark

This update for wireshark fixes the following issues: - CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. - CVE-2026-15164: Denial of Service vulnerability in ciscodump bsc1271134. - CVE-2026-15166: Denial of Service via IEEE 802.11 protocol dissector...

CVE-2026-69401: Use After Free

Use after free in Audio Video Control Transport Protocol allows an authorized attacker to elevate privileges locally...

CVE-2026-72930: Use After Free

Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an authorized attacker to execute code locally...

CVE-2026-71332: Use After Free

Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an authorized attacker to elevate privileges locally...

PT-2026-87436

Use after free in Audio Video Control Transport Protocol allows an authorized attacker to elevate privileges locally...

PT-2026-88442

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

PT-2026-87688

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A heap-based buffer overflow exists in the Windows Link Layer Topology Discovery Protocol. This flaw allows an unauthorized remote attacker to execute arbitrary code over a network and affect...

CVE-2026-69564: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Online Certificate Status Protocol OCSP allows an authorized attacker to elevate privileges locally...

CVE-2026-70587: Improper Null Termination

Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network...

CVE-2026-73009: Use After Free

Use after free in Windows Secure Socket Tunneling Protocol SSTP allows an unauthorized attacker to execute code over a network...

CVE-2026-69732: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over a network...

PT-2026-87016

NuBrowser lacks protocol whitelist validation for the S.browser fallback url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websit...

Fedora 43 : nsd (2026-3ff003d397)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ff003d397 advisory. BUG FIXES: Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networ...

Fedora 44 : nsd (2026-bf1539678e)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf1539678e advisory. BUG FIXES: Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networ...

CVE-2026-72931: Missing Release of Resource after Effective Lifetime

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol SSTP allows an authorized attacker to deny service locally...

CVE-2026-44756: Buffer Copy without Checking Size of Input

A memory safety vulnerability exists in the Extended Passport Protocol EPP processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

EternalRomance-Exploit-Against-Windows-Machine

Overview EternalRomance is a critical Windows remote code execu...

DEBIAN-CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...

CVE-2026-16028

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that streamstate never removes from the connection stream table. When a stream reaches the CLOSED state, streamstate returns the concurrency slot and clears most of the stream's keys, but the entry itself sta...