Amazon Linux 2 : 389-ds-base, --advisory ALAS2-2026-3853 (ALAS-2026-3853)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3853 advisory. A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server389-ds-base. After a successful SASL bin...

MiracleLinux 8 : gstreamer1-plugins-bad-free-1.16.1-9.el8_10.1 (AXSA:2026-1442:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1442:02 advisory. gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer CVE-2026-59691 gstreamer: gstreamer: DTLS certificate...

Important: gstreamer1-plugins-bad-free

Issue Overview: A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 video file containing malformed MVC or SVC extension slice NAL units, a 1-byte heap out-of-bounds read can occur during parsing. This happens when the parser attempts to check slice...

ALSA-2026:49914 Low: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

RHEL 10 : libgcrypt (RHSA-2026:50144)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50144 advisory. The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: Libgcrypt: Libgcrypt: Denial of...

libgcrypt security update

1.11.0-7 - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext 1.11.0-6 - Disable annocheck on riscv64 fixes build Resolves: RHEL-88837...

mingw-glib2 security update

2.70.1-9 - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 2.70.1-8 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves: RHEL-212184 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234 2.70.1-6 - Fix CVE-2026-58012...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...

ALSA-2026:50144 Moderate: libgcrypt security update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext CVE-2026-41989 For more details about the security issues, including the impact, a CVSS score...

Moderate: libgcrypt security update

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext CVE-2026-41989 For more details about the security issues, including the impact, a CVSS score...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-1451:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1451:01 advisory. DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-9698 Tenable has extracted the preceding description block directly...

RHEL 9 : libgcrypt (RHSA-2026:50147)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50147 advisory. The libgcrypt library provides general-purpose implementations of various cryptographic algorithms. Security Fixes: Libgcrypt: Libgcrypt: Denial of...

Amazon Linux 2023 : python3-tornado (ALAS2023-2026-2016)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2016 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...

libgcrypt security update

1.10.0-13 - Bump version to fix wrong build target. 1.10.0.12 - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext...

CVE-2026-67858

The CVE affects open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled via the MDNSD backend. A remote unauthenticated attacker can send RegisterServer or RegisterServer2 requests containing many unique discoveryUrls, triggering a denial-of-service. This i...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...

CVE-2026-67859

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling...

Important: freerdp

Issue Overview: Heap-buffer-overflow write in AVC444 YUV buffer allocation In libfreerdp/codec/h264.c, avc444ensurebuffer computes the AVC444 YUV444 intermediate buffer size as piDstSizex = piDstStridex padDstHeight using UINT32 arithmetic. When the true product exceeds UINT32MAX, the value wraps...

CVE-2026-67859

Technical details for CVE-2026-67859 are not publicly available in the provided documents; monitor for updates.

Medium: libxml2

Issue Overview: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can...