RHSA-2026:49401 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RockyLinux 8 : frr (RLSA-2026:49511)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49511 advisory. frr: FRRouting: Denial of Service via crafted BGP UPDATE message CVE-2026-37460 Tenable has extracted the preceding description block directly from the RockyLinu...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit CVE-2026-43091 In the Linux kernel, the following...

Important Photon OS Security Update - PHSA-2026-5.0-92-0940

Updates of 'mysql' packages of Photon OS have been released...

Important: kernel-livepatch-6.12.92-122.166

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: python3.12

Issue Overview: The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the Tarfile.extract function, the filter parameter is not passed properly when extracting...

Linux Distros Unpatched Vulnerability : CVE-2026-64562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1995)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1995 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-2037)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2037 advisory. NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source packageNOTE: depending on 7zip. Mark this version as fixed version.NOTE:...

Important Photon OS Security Update - PHSA-2026-5.0-0940

Updates of 'mysql' packages of Photon OS have been released...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-2018)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2018 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

RockyLinux 10 : p11-kit (RLSA-2026:49668)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49668 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from th...

Linux Distros Unpatched Vulnerability : CVE-2026-18772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion. CVE-2026-18772 Note that Ness...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-1450:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1450:01 advisory. DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-9698 Tenable has extracted the preceding description block directly...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

@24hr/content-next (>=1.0.0, <=3.0.18), @24hr/natswrapper (>=1.0.0, <=1.0.20) +339 more potentially affected by CVE-2026-69240 via sequelize (>=6.0.0-beta.4, <=6.37.3)

sequelize NPM version =6.0.0-beta.4, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =15.0.0, =1.0.0, =1.0.43, =0.13.0, =5.0.0-alpha.3, =13.0.7-feature-244b53-kvkvw2nk, =1.0.63, =1.0.2, =1.1.3 and more Source cves: CVE-2026-69240 Source advisory: OSV:GHSA-V8FG-2RW7-Q452...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +756 more potentially affected by CVE-2026-69207 via hono (>=4.0.0, <=4.12.33)

hono NPM version =4.0.0, =0.1.0-dev.2580522, =0.1.8-fix.3, =0.0.2, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-69207 Source advisory: SNYK:JS-HONO-18517010...

GHSA-QWWW-VCR4-C8H2 vulnerabilities

Vulnerabilities for packages: vitess, librechat...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +129 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =1.0.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =1.0.118 and more Source cves: CVE-2026-69192 Source advisory: OSV:GHSA-MWP4-54F8-5FHR...

@0x0.bug/pi-coding-agent (1.0.0), @0xwork/connect (>=0.1.0, <=0.1.9) +1195 more potentially affected by CVE-2026-16728 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =2026.6.2, =2026.6.5 and more Source cves: CVE-2026-16728 Source...