Linux Distros Unpatched Vulnerability : CVE-2026-91725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. Chromium...

apr-util security update

1.6.1-9.1 - Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 - Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 - Resolves...

ROS-20260923-73-0057

The vulnerability of the chachacryptarch function in the arch/s390/crypto/chacha-glue.c module, which is part of the S390 platform support in the Linux operating system, is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause a...

ROS-20260923-73-0054

The vulnerability of the ipv6findtlv function in the net/ipv6/exthdrscore.c module of the Linux kernel involves reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-95302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebAPKs. CVE-2026-95302 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

Linux Distros Unpatched Vulnerability : CVE-2026-95358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Mobile. CVE-2026-95358 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenabl...

Linux Distros Unpatched Vulnerability : CVE-2026-95375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in BrowserTag. CVE-2026-95375 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

ROS-20260923-73-0086

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260923-73-0035

The vulnerability of the copytoiter function in the Linux operating system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to trigger a service failure...

ROS-20260923-73-0039

The vulnerability of the ppsregistercdev function in the Linux operating system is related to the disclosure of information in error messages. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260923-73-0033

The vulnerability of the netdevallocskbipalign function in the Linux operating system is related to a pointer arithmetic error. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-91018

lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-88341

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration numbuffers=0 that triggers an assertion failure in yrarenagetptr, causing the application to terminate...

CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

CVE-2026-88339

A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone function of GPAC 2d7da22e 26.08-DEV. The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition,...

podman: podman: Quadlet install --replace non-truncating write retains removed host-access directives

The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt fails common on non-reflink-capable filesystems including many RHEL default XFS configurations, the fallback in ReflinkOrCopy uses io.Cop...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses

A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak p...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...