UBUNTU-CVE-2026-95114

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service...

MiracleLinux 9 : dovecot-2.3.16-18.el9_8.8 (AXSA:2026-2051:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2051:08 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorre...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tftp (UTSA-2026-130162)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130162 advisory. A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass...

Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82040)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly fr...

Rocky Linux 10.2 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82041)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...

RHEL 9 : openssl (RHSA-2026:83617)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83617 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Debian dla-4835 : libmariadb-dev - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4835 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4835-1 [email protected]...

UBUNTU-CVE-2026-109833

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reac...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

AlmaLinux 8 : kernel-rt (ALSA-2026:83159)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83159 advisory. kernel: Linux kernel: Denial of Service due to use-after-free in acttunnelkey CVE-2026-68377 kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytese...

Oracle Linux 8 : grafana (ELSA-2026-83544)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-83544 advisory. - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 - CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN...

RHCOS 4 : OpenShift Container Platform 4.18.57 (RHSA-2026:79034)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:79034 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

Rocky Linux 9 [CIQ] Security Update: librabbitmq / librabbitmq-debuginfo / librabbitmq-debugsource / etc (crlsa-2026_82094)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682094 advisory. rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service CVE-2026-44236 Tenable has extracted the preceding description block directly from the CI...

RHEL 9 : ruby (RHSA-2026:83574)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83574 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

AlmaLinux 8 : kernel (ALSA-2026:83157)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83157 advisory. kernel: Linux kernel: Denial of Service due to use-after-free in acttunnelkey CVE-2026-68377 kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytese...

PT-2026-115159

Game Music Emu libgme through 0.6.5 contains a global out-of-bounds read vulnerability in Classic Emu::mute voices that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip flags 0x3F,...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

grafana security update

9.2.10-35.0.1 - Fixes CVE-2024-1442 Add email verification when updating user email Orabug: 38550520 9.2.10-35 - CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION - Resolves RHEL-253157 9.2.10-34 - CVE-2026-42504 grafana: Golang MIME: Denial o...

UBUNTU-CVE-2026-107349

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignorestartupparameters list lookup loop forever. Because PgBouncer serve...

CVE-2026-107348

Integer overflow in the message buffer growth logic mbufmakeroom in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when maxpacketsize is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow,...