Important: pipewire

Issue Overview: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return. CVE-2026-14324 Multiple unbounded alloca calls in the PulseAudio protocol server. CVE-2026-14330 A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker t...

Amazon Linux 2023 : python3-pyasn1, python3-pyasn1-modules (ALAS2023-2026-2000)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2000 advisory. pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound ...

Important: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-2020)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2020 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

Medium: openssh

Issue Overview: A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes...

Amazon Linux 2 : 389-ds-base, --advisory ALAS2-2026-3853 (ALAS-2026-3853)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3853 advisory. A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server389-ds-base. After a successful SASL bin...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2026-2036)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2036 advisory. A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3839 (ALAS-2026-3839)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3839 advisory. Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1999)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1999 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1996)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1996 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3846 (ALAS-2026-3846)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3846 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...

Amazon Linux 2023 : rclone (ALAS2023-2026-2002)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2002 advisory. Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text...

Amazon Linux 2 : python, --advisory ALAS2-2026-3845 (ALAS-2026-3845)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3845 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser...

Important: kernel-livepatch-6.18.25-55.108

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: kernel-livepatch-6.18.25-57.109

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: xfrm: Wait for RCU readers during policy netns exit CVE-2026-43091 In the Linux kernel, the following...

Important: acl

Issue Overview: A flaw was found in the acl component, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or wri...

Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-2015)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2015 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...

Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-015 (ALASNGINX1-2026-015)

The version of nginx installed on the remote host is prior to 1.30.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-015 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string...