Amazon Linux 2 : iscsi-initiator-utils, --advisory ALAS2-2026-3897 (ALAS-2026-3897)

The version of iscsi-initiator-utils installed on the remote host is prior to 6.2.0.874-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3897 advisory. open-iscsi: open-iscsi: Stack buffer overflow in idbm record parsing CVE-2026-18724 open-iscsi:...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-2096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2096 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...

Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-2102)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2102 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2023 : python3.14-pip, python3.14-pip-wheel (ALAS2023-2026-2093)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2093 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to...

Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2026-3888 (ALAS-2026-3888)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.504.b01-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3888 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-2091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2091 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2026-2078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2078 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-028 (ALASTOMCAT9-2026-028)

The version of tomcat installed on the remote host is prior to 9.0.121-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2026-028 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat:...

Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-2094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2094 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...

Amazon Linux 2023 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2023-2026-2118)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2118 advisory. A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message lengt...

Amazon Linux 2023 : gd, gd-devel, gd-progs (ALAS2023-2026-2103)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2103 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152 CVE-2026-9672 Tenable has extracted the preceding description block directly...

Important: iperf3

Issue Overview: A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive...

Amazon Linux 2 : samba, --advisory ALAS2-2026-3886 (ALAS-2026-3886)

The version of samba installed on the remote host is prior to 4.10.16-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3886 advisory. A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory...

Amazon Linux 2 : mrtg, --advisory ALAS2-2026-3884 (ALAS-2026-3884)

The version of mrtg installed on the remote host is prior to 2.17.4-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3884 advisory. A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged...

Amazon Linux 2 : postgresql, --advisory ALAS2-2026-3900 (ALAS-2026-3900)

The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3900 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to caus...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2106 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock CVE-2026-45897 In the Linux kernel, the following vulnerability has bee...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2110)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2110 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftcounter: serialize reset with spinlock CVE-2026-45897 In the Linux kernel, the following vulnerability has bee...

Amazon Linux 2 : kbd, --advisory ALAS2-2026-3885 (ALAS-2026-3885)

The version of kbd installed on the remote host is prior to 1.15.5-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3885 advisory. openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2026-2100)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2100 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Amazon Linux 2 : apr-util, --advisory ALAS2-2026-3892 (ALAS-2026-3892)

The version of apr-util installed on the remote host is prior to 1.6.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3892 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or password...