ROS-20261022-73-0085

A vulnerability exists in the smartcardoperationfree function of the RDP client FreeRDP. This vulnerability is related to the assignment of a null pointer during the device control request cleanup process. This allows an attacker to trigger a service failure on the client side...

ROS-20261022-73-0097

The vulnerability in freerdp3 is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261022-73-0052

The vulnerability in java-25-openjdk is related to uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Oracle Enterprise Manager Cloud Control (October 2026 CPU)

The 13.5.0.0 and 24.1.0.0 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager componen...

PT-2026-121307

The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue calls readArray and readObject, which call nextValue again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes t...

RHEL 8 : rsyslog (RHSA-2026:87408)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87408 advisory. The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists,...

PT-2026-121558

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll oneoff adapter, which performs On host work per subscription without consuming or checking fuel. Malicious guest modules can pass many...

PT-2026-121291

A flaw was found in mod qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an...

ROS-20261022-73-0109

The vulnerability of the xmtnodestart function in the MP4Box utility of the GPAC multimedia platform, related to the use of memory after its release during processing an incorrect XMT scene, allows a perpetrator to trigger a Denial-of-Service Attack DoS...

ROS-20261022-73-0111

The vulnerability of the gfsgprotofieldissftimeoffset function in the MP4Box utility of the GPAC multimedia platform is related to an uncontrolled recursion during the processing of PROTO/IS connections for MPEG-4 BIFS/VRML scenes. This vulnerability allows a attacker to trigger a Denial-of-Servi...

PT-2026-121421

Name of the Vulnerable Software and Affected Versions GraphQL-core versions 3.2.3 through 3.2.11 GraphQL-core version 3.3.0rc1 prior to fix Description An unauthenticated remote attacker can cause a denial of service through memory exhaustion. The issue exists because the max tokens limit in...

PT-2026-121388

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode auth.html component...

Rocky Linux 8 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_85916)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685916 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

CentOS Linux 7 [TuxCare] Security Update: libevent / libevent-devel / libevent-doc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792536927)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792536927 advisory. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handle...

Rocky Linux 9 [CIQ] Security Update: hostapd / hostapd-debuginfo / hostapd-debugsource (crlsa-2026_85277)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685277 advisory. hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request CVE-2026-58374 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-96638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and...

AlmaLinux 9.6 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792628290)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792628290 advisory. - An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service DoS via th...

Red Hat: CVE-2026-110354: haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service persistent worker-thread CPU exhaustion via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without...

Red Hat: CVE-2026-110353: haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service worker-thread CPU exhaustion via a truncated HTTP/2 PING frame. h2chandleping in src/muxh2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be...

ALSA-2026:88248 Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: expat: Denial of Service via integer overflow in expatrealloc CVE-2026-102633 expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer CVE-2026-77214 For more details about the security issues, includin...