Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:41949 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:42063 Important: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer underflow in...

AlmaLinux 10 : python3.14 (ALSA-2026:40856)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:40856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

PT-2026-61576

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description The value and JSON parser fails to enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. Unauthenticated attackers can exploit this by sending deeply...

dovecot security update

1:2.3.21-19.1 - fix CVE-2026-42006: fix imapparser listcountlimit to actually work RHEL-188477...

PT-2026-61550

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description A denial of service issue exists in the SurrealML header parser. Authenticated users with the Owner role can crash the server by uploading a malformed .surml file to the '/ml/import' endpoint. By...

CVE-2026-63760: Uncontrolled Recursion

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

CVE-2026-63759: Uncontrolled Recursion

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process...

CVE-2026-46671: Improper Limitation of a Pathname to a Restricted Directory

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...

CVE-2026-63734: Improper Input Validation

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1955)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1955 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

Linux Distros Unpatched Vulnerability : CVE-2026-63091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1956)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1956 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

MAL-2026-10780 Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

CVE-2026-63891

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-63868

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

DEBIAN-CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...