Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2026-3888 (ALAS-2026-3888)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.504.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3888 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-2095)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2095 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...

Amazon Linux 2 : gstreamer-plugins-good, --advisory ALAS2-2026-3898 (ALAS-2026-3898)

The version of gstreamer-plugins-good installed on the remote host is prior to 0.10.31-20. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3898 advisory. A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader...

Amazon Linux 2 : freerdp (ALAS-2026-3887)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3887 advisory. FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the...

Amazon Linux 2 : libsoup, --advisory ALAS2-2026-3876 (ALAS-2026-3876)

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3876 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specifie...

Amazon Linux 2023 : postgresql18, postgresql18-contrib, postgresql18-llvmjit (ALAS2023-2026-2079)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2079 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2 : golang, --advisory ALAS2-2026-3893 (ALAS-2026-3893)

The version of golang installed on the remote host is prior to 1.26.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3893 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2106 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock CVE-2026-45897 In the Linux kernel, the following vulnerability has bee...

Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory. libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection CVE-2026-61477...

Important: tomcat

Issue Overview: Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the...

Important: iperf3

Issue Overview: A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive...

Amazon Linux 2023 : libXfont2, libXfont2-devel (ALAS2023-2026-2112)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2112 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fai...

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-2086)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2086 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames...

Medium: gd

Issue Overview: NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24 DEBIANBUG: 1143152 CVE-2026-9672 Affected Packages: gd Issue Correction: Run dnf update gd --releasever 2023.12.20260831 or dnf update --advisory ALAS2023-2026-2103 --releasev...

Medium: python3.14-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Amazon Linux 2023 : kbd, kbd-legacy, kbd-misc (ALAS2023-2026-2109)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2109 advisory. openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateus...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-2092)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2092 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : gd, gd-devel, gd-progs (ALAS2023-2026-2103)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2103 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152 CVE-2026-9672 Tenable has extracted the preceding description block directly...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-2094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2094 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...