839 matches found
AlmaLinux 9.6 [TuxCare] Security Update: grafana-pcp Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772448804)
The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772448804 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...
Rocky Linux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1773138498)
The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773138498 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameter...
AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2026:1772464786)
The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1772464786 advisory. - During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake...
Rocky Linux 8 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc Multiple Vulnerabilities (crlsa-2026_3898)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263898 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...
Rocky Linux 9 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_4177)
The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20264177 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...
Rocky Linux 9 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource (crlsa-2026_3842)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20263842 advisory. crypto/tls: Unexpected session resumption in crypto/tls CVE-2025-68121 Tenable has extracted the preceding description block directly from the CIQ security advisory...
Rocky Linux 10.1 [CIQ] Security Update: golang-github-openprinting-ipp-usb-debugsource / ipp-usb / etc Multiple Vulnerabilities (crlsa-2026_3092)
The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263092 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...
AlmaLinux 9.2 [TuxCare] Security Update: delve (ALMALINUX9.2:CLSA-2026:1773313831)
The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773313831 advisory. - During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake...
CLEANSTART-2026-IU74948 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
CVE-2025-68121 affects multiple packages. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. See references for...
AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1772123920)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1772123920 advisory. - During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake...
AlmaLinux 9.6 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772576264)
The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772576264 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
RHEL 9 : git-lfs (RHSA-2026:72276)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:72276 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...
CVE-2026-94419 Client session cache reference poisoning allows resumption with wrong server
Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124492)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124492 advisory. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake...
crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...
CVE-2026-92916
Grav, a flat-file CMS, is affected by an unauthenticated information disclosure in versions 1.7.0–1.7.53.2 and 2.0.0–2.0.21 when the debugger is enabled (system.debugger.enabled: true, not the default). The Clockwork profiler endpoint (/__clockwork/) is intercepted during bootstrap without any au...
CVE-2026-92916 Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled system.debugger.enabled: true, which is not the default, the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest intercepts any path...