Oracle Linux 10 : dovecot (ELSA-2026-41988)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41988 advisory. 1:2.3.21-19.1 - fix CVE-2026-42006: fix imapparser listcountlimit to actually work RHEL-188477 Tenable has extracted the preceding description block directly...

RHEL 9 : python3.14 (RHSA-2026:41949)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:41949 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2026-63759: Uncontrolled Recursion

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process...

CVE-2026-64624: Improper Neutralization of Argument Delimiters in a Command

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

ALSA-2026:41949 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:42063 Important: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer underflow in...

dovecot security update

1:2.3.21-19.1 - fix CVE-2026-42006: fix imapparser listcountlimit to actually work RHEL-188477...

CVE-2026-63760: Uncontrolled Recursion

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

PT-2026-114706

Уязвимость компонента Parser веб-браузеров Google Chrome и Microsoft Edge связана с недостаточной проверкой необычных или исключительных состояний. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально созданной HTML-страницы...

Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1955)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1955 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...

Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: clamav1.5

Issue Overview: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for...

CVE-2026-46671: Improper Limitation of a Pathname to a Restricted Directory

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...

MAL-2026-10780 Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

CVE-2026-63891

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...

CVE-2026-63868

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

DEBIAN-CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-63891 thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Cap recursion depth in tbpropertyparsedir A DIRECTORY entry's value field is used as the diroffset for a recursive call into tbpropertyparsedir with no depth counter. A crafted peer that chains DIRECTORY...