CVE-2025-60489

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:86203)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86203 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/http: golang:...

RHEL 10 : golang (RHSA-2026:86093)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86093 advisory. The golang packages provide the Go programming language compiler. Security Fixes: net/http: golang: golang: Denial of Service via crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-114095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential...

Linux Distros Unpatched Vulnerability : CVE-2026-77207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type...

Linux Distros Unpatched Vulnerability : CVE-2026-77206

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2...

Linux Distros Unpatched Vulnerability : CVE-2026-109680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdpinterruptiblegetline, which shrinks the buffer to 32 bytes while keeping a pre-fille...

CVE-2025-60493

A segmentation violation in the checkmediaprofile function /mp4box/mp4box.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Linux Distros Unpatched Vulnerability : CVE-2026-94453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or...

RHEL 10 : .NET 9.0 (RHSA-2026:86172)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86172 advisory. .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It...

GPAC MP4Box security vulnerability

A security vulnerability exists in GPAC MP4Box versions prior to 2.5. This vulnerability stems from a use-after-free issue in the gfodfac4cfgcleanlist function located in /odf/descriptors.c. Attackers can exploit this by providing a specially crafted AC4 file, resulting in a denial of service...

GPAC MP4Box security vulnerability

A security vulnerability exists in GPAC MP4Box versions prior to 2.5. This vulnerability stems from a null pointer dereference in the StatSFVec2f function located at /scenemanager/scenestats.c, which may allow attackers to cause a denial of service by providing specially crafted MPEG-4 files...

PT-2026-120779

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp i2c gpio target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-reg addr and the data-phase flag b-rxtx were never cleare...

Vaadin Framework resource management error vulnerability

A security vulnerability exists in Vaadin Framework versions 8.16.0 through 8.32.1. It arises because requestEnd reads the v-uiId request parameter outside of the code block responsible for releasing the session lock. Since the value is not a numeric v-uiId, Integer.parseInt throws an exception,...

RHEL 10 : dogtag-pki (RHSA-2026:86621)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86621 advisory. IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the...

RockyLinux 10 : hostapd (RLSA-2026:85276)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:85276 advisory. hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request CVE-2026-58374 Tenable has extracted the preceding descriptio...

AlmaLinux 9 : openssh (ALSA-2026:85958)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85958 advisory. openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-59997 openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck...

PT-2026-120725

The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. Whe...

RockyLinux 10 : openssh (RLSA-2026:85847)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85847 advisory. openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-59997 openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorChec...

RHEL 8 : perl-DBI:1.641 (RHSA-2026:85916)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:85916 advisory. The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent...