PT-2026-108151

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before verifying if the input contains the declared bytes. A specially crafted file such as MP3, FLAC,...

PT-2026-108297

Name of the Vulnerable Software and Affected Versions Azure App Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized, network-reachable attacker to execute arbitrary code without providing credentials. Recommendations At the...

PT-2026-108200

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get pac princ with realm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

PT-2026-108150

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The APEv2 parser in music-metadata contains an issue where it reads a tag-item size controlled by an attacker and allocates a Uint8Array for a binary item before verifying if the declared si...

PT-2026-107974

ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service...

CVE-2026-95208

An issue in the ConfirmNameConstraints function wolfcrypt/src/asn.c of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service DoS via providing crafted Certificate Authority certificates, leading to valid certificates without SAN to be incorrectly rejected by wolfSSL-based TLS...

PT-2026-107823

An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid inputs like special characters leading to a Denial of Service DoS when collecting “supportsave” from a Brocade Switch...

Python Library Django 5.2.x < 5.2.18 / 6.0.x < 6.0.9 / 6.1.x < 6.1.2 Multiple Vulnerabilities

The detected version of the Django Python package is 5.2.x prior to 5.2.18, or 6.0.x prior to 6.0.9, or 6.1.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities, including: - django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attac...

RockyLinux 8 : glibc (RLSA-2026:76777)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76777 advisory. glibc: Process abort due to invalid memory in wordexp CVE-2026-6368 glibc: Denial of Service via stack exhaustion during tilde expansion CVE-2026-6791...

RHEL 9 : perl-DBI (RHSA-2026:76760)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76760 advisory. The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent...

RHEL 9 : opentelemetry-collector (RHSA-2026:76744)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:76744 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: google.golang.org/grpc: gRPC-Go: Denial of Service via...

MiracleLinux 8 : freerdp-2.11.7-14.el8_10 (AXSA:2026-1998:31)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1998:31 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:76744)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:76744 advisory. google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84445 Tenable has extracted the preceding description block directly from...

PT-2026-107776

A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly...

RHEL 9 : kernel (RHSA-2026:77219)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77219 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv6: add NULL checks for ide...

EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3894)

According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a he...

RHEL 10 : kernel (RHSA-2026:77634)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77634 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fs/notify: call...

RockyLinux 9 : nodejs:22 (RLSA-2026:76750)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76750 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

RockyLinux 8 : perl-DBI (RLSA-2026:77576)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:77576 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

EulerOS 2.0 SP15 : containerd (EulerOS-SA-2026-3902)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a...