Important: gstreamer1-plugins-good

Issue Overview: GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target mus...

Important: libtiff

Issue Overview: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.12.20260914 or dnf...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2026-2132)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2132 advisory. A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream- dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes...

Important: python-mistune

Issue Overview: Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in...

Important: kernel-livepatch-6.18.35-68.129

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel-livepatch-6.18.35-68.129 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: libheif

Issue Overview: libheif: Integer underflow in Fraction constructor via double clap transform application CVE-2026-62289 libheif: Out-of-bounds read in uncompressed unci tile range slicing CVE-2026-62292 Affected Packages: libheif Issue Correction: Run dnf update libheif --releasever...

Amazon Linux 2023 : composer (ALAS2023-2026-2152)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2152 advisory. Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the...

Amazon Linux 2 : openssl (ALAS-2026-3919)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3919 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL to buffer far...

Amazon Linux 2023 : mod_auth_openidc (ALAS2023-2026-2155)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2155 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-2140)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2140 advisory. GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

Amazon Linux 2 : perl-YAML (ALAS-2026-3918)

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3918 advisory. Backtracking leads to exponential load time in libyaml library. CVE-2026-63676 Tenable has extracted the preceding description blo...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2026-012)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2026-012 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2026-2157)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2157 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violatio...

Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)

The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...

Amazon Linux 2023 : libevent, libevent-devel (ALAS2023-2026-2128)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2128 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five...

Amazon Linux 2 : wireshark (ALAS-2026-3905)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3905 advisory. C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76879 C12.22...

Amazon Linux 2023 : libvirt, libvirt-client, libvirt-client-qemu (ALAS2023-2026-2139)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2139 advisory. A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check,...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-2135)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2135 advisory. A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as ...

Amazon Linux 2023 : ruby4.0, ruby4.0-bundled-gems, ruby4.0-default-gems (ALAS2023-2026-2144)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2144 advisory. An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new...

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2026-009)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2LIBREOFFICE-2026-009 advisory. LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed wh...