SUSE-SU-2026:22990-1 Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

SUSE-SU-2026:22991-1 Security update for the Linux Kernel (Live Patch 3 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

SUSE-SU-2026:22988-1 Security update for the Linux Kernel (Live Patch 6 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. ...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

Le Panthéon de la Souveraineté — Updated!

🏠 Developed on: GitLab | 🪞 Automated mirror on: GitHub 🏛️ The Pantheon of Sovereignty A 100% sovereign, redundant and secure cloud infrastructure, designed to completely break free from GAFAM. Version 1.1: Private network foundation, DNS request encryption for servers DoT and multi-datacenter...

PT-2026-76549

It was discovered that OpenSSL incorrectly allocated memory buffers in the SSL/TLS state machine when receiving handshake data. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue is known as the "HollowByte"...

Linux Distros Unpatched Vulnerability : CVE-2026-56850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across request...

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

CVE-2026-12996: Use After Free

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-5846: Use of Hard-coded Cryptographic Key

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's built-in web management interface. These keys are embedded in plaintext within the...

CVE-2026-58040: Improper Validation of Certificate with Host Mismatch

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

CVE-2026-12932: Missing Release of Memory after Effective Lifetime

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service memory exhaustion via a flood of crafted packets...

CVE-2026-13117: Use After Free

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

Apache Traffic Server improper exception handling vulnerability

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. It addresses an issue related to improper exception handling, which stems from empty pointer dereferencing and dangling references memory errors that occur during TLS and SNI...

PT-2026-66409

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description An incomplete fix exists in the HTTPS Agent where TLS session reuse allows the system to skip hostname verification across identity policies. Recommendations Update...

RHEL 9 : grafana-pcp (RHSA-2026:47721)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:47721 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

RHEL 9 : golang (RHSA-2026:47712)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47712 advisory. The golang packages provide the Go programming language compiler. Security Fixes: crypto/tls: Unexpected session resumption in crypto/tls...

RHEL 9 : osbuild-composer (RHSA-2026:48036)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:48036 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RHEL 9 : osbuild-composer (RHSA-2026:47910)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47910 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...