EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2026-2853)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data.CVE-2026-291...

ALSA-2026:42828 Important: httpd:2.4 security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 httpd: NULL pointer dereference via specially crafted request CVE-2026-29169 httpd: Apache HTTP Server: Heap-based Buffer...

PT-2026-62125

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctp i2c gpio target.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctp i2c gpio target write received without validating the order or the receive buffer. In the affected versions the MCTP I2C GPIO RX MSG...

PT-2026-63280

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The AddTime API handler fails to stop execution after an error is returned by the GetUserByName function. When a repository administrator provides a non-existent user name, the system generates...

PT-2026-61865

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description An invalid pointer exists within the Bindings WebIDL...

PT-2026-61879

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A sandbox escape is possible due to an invalid pointer within the Disability Access APIs component. A sandbox is a security mechanism used to isolate running...

EulerOS Virtualization 2.12.0 : expat (EulerOS-SA-2026-2771)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...

EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2026-2849)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately...

CVE-2026-44507

...

CVE-2026-44507

Removed by vendor...

CVE-2026-44507

...

Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

MGASA-2026-0273 Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftpsymlink in sftp.c. CVE-2025-15661 libssh2 userauth.c userauthpassword integer overflow. CVE-2026-7598 Pre-Authentication DoS via SSHMSGEXTINFO Handler. CVE-2026-55199 Out-of-Bounds Write via Unchecked packetlength in...

MGASA-2026-0283 Updated perl-JavaScript-Minifier-XS package fixes security vulnerabilities

The updated package fixes security vulnerabilities: JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. CVE-2026-56017 JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call...

CVE-2026-64194

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...

CVE-2026-64190

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...

CVE-2026-64207

In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NETXMITSUCCESS. The parent then accounts for the original skb once...

CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...

CVE-2026-47276

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in propertiesparse allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with userproperties as a JSON array instead of a JSON object. The crash occurs because strlen is call...

CVE-2026-47275

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in nnimqttv5msgdecodeconnect allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client including bridge mode with a single packet, causing remote denial of service via SIGSEGV. In nnimqttv5msgdecodeconnect...