CVE-2026-8674

A assertion failure in the DNS stub resolver of the GNU C Library (glibc) versions 2.26 through 2.44 aborts any process that resolves names through the library. The root cause is that when the search list in /etc/resolv.conf or the LOCALDOMAIN environment variable contains a domain of roughly 200...

CVE-2026-8674 Assertion failure in the DNS stub resolver with a long search domain

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates...

CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

DEBIAN-CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

CVE-2026-91959

FreeRDP before 3.31.0 contains a buffer over-read in the rts_read_result function within the RPC gateway transport parser . The root cause is that the function length-checks 2 bytes but then reads 4 , allowing a remote attacker to send a malicious BIND_ACK PDU with a truncated result entry to tri...

EUVD-2026-78635

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

CVE-2026-91959 FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

Linux Distros Unpatched Vulnerability : CVE-2026-91959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a...

PT-2026-92078

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts read result function within the RPC gateway transport parser. Attackers can send a malicious BIND ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...

Updated libcupsfilters & cups-filters packages fix security vulnerabilities

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel. CVE-2026-64611 cups image filter process abort via malformed png. CVE-2026-64612...

MGASA-2026-0407 Updated libcupsfilters & cups-filters packages fix security vulnerabilities

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel. CVE-2026-64611 cups image filter process abort via malformed png. CVE-2026-64612...

CVE-2026-85201

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload granted Control Interface access can specify an excessive message length, causing an unbounded...

CVE-2026-85534

A flaw in libsoup 's HTTP/2 client can crash the process when a malicious server manipulates flow-control settings. When a client sends a request body from a non-pollable input stream , the library may buffer more data than the current flow-control window allows. A remote HTTP/2 server can then s...

SUSE-SU-2026:3935-1 Security update for cups-filters

This update for cups-filters fixes the following issues: - CVE-2026-64611: user who controls an IEEE-1284 device ID consumed by cfIEEE1284GetMakeModel can drive cfIEEE1284NormalizeMakeModel into an infinite loop bsc1273145. - CVE-2026-64612: authenticated client that can submit an image print job...

Python Library OpenEXR 3.4.0 < 3.4.13 DoS (CVE-2026-53532)

The version of the OpenEXR Python package installed on the remote host is 3.4.x prior to 3.4.13. It is, therefore, affected by a denial of service vulnerability: - A crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted...

CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

MiracleLinux 9 : cups-filters-1.28.7-27.el9_8 (AXSA:2026-1645:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1645:03 advisory. libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG CVE-2026-64612 Tenable has extracted the preceding descriptio...

CVE-2026-53532

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted input...

DEBIAN-CVE-2026-53532

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted input...

UBUNTU-CVE-2026-53532

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exrstartread on untrusted input...