Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89407 com.fasterxml.jackson.core/jackson-core:...

Important: qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase:...

CVE-2026-73206

A crafted DNS packet can cause a denial of service decompressing the DNS names in the packet...

Critical: .NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Red Hat: CVE-2026-96638: pillow: pillow: Denial of Service via crafted RLE BMP image

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...

PT-2026-120818

Name of the Vulnerable Software and Affected Versions Pillow versions 9.1.0 through 12.x Description The BmpRleDecoder.decode function in src/PIL/BmpImagePlugin.py allows crafted RLE BMP delta escapes and absolute-mode runs to append data beyond the remaining dest length because it lacks a...

Red Hat: CVE-2026-96888: bind: bind: Denial of Service via assertion failure during redirect processing

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1...

Encode Django REST framework resource management error vulnerability

Encode Django REST framework versions prior to 3.18.2 contain a resource management error vulnerability. This vulnerability arises because JSONParser.parse uses the Content-Type charset value provided by the client to call codecs.getreader, accepting byte conversion and decoding encoders such as...

Apache bRPC buffer error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a buffer error vulnerability. This vulnerability arises because the Discovery naming service reply parser fails to validate whether JSON values represent objects before invoking the RapidJSON accessor, which is designed solely for objects. When...

Apache bRPC buffer error vulnerability

Versions 1.11.0 through 1.17.0 of Apache bRPC contain a buffer error vulnerability. This vulnerability arises because the streaming RPC client fails to validate the size of the returned list of extrastreamids prior to processing StreamSettings responses. It then returns identifiers by using a loc...

Atlassian Confluence 7.16.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104502)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104502 advisory. - Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring...

RHEL 10 : gnome-remote-desktop (RHSA-2026:86194)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:86194 advisory. GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fixes: gnome-remote-desktop:...

AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792570553)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792570553 advisory. - An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: expat (UTSA-2026-142314)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142314 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N...

AlmaLinux 8 : .NET 9.0 (ALSA-2026:86170)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86170 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information...

AlmaLinux 9 : .NET 10.0 (ALSA-2026:86193)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86193 advisory. dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability CVE-2026-102870 dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service...

RockyLinux 10 : openssh (RLSA-2026:85847)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85847 advisory. openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-59997 openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorChec...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (crlsa-2026_84798)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smugglin...

Linux Distros Unpatched Vulnerability : CVE-2026-109267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because Redis’s inline command parsing allocates memory and copies the entire input buffer based on its current size before determining the command boundary; there is no proper lim...