ROS-20260708-73-0037

The vulnerability of the iconv function in the GNU C Library is related to an uncontrolled and exploitable condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...

ROS-20260708-73-0039

The vulnerability in glibc is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20260708-73-0038

The vulnerability in glibc is related to the execution of an operation outside the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the magick/profile.c file, a console-based image editor from ImageMagick, allows a hacker to execute arbitrary code.

The vulnerability of the magick/profile.c file, a console-based image editing tool from ImageMagick, is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

c-ares: c-ares: Use-after-free / double-free in query-completion handling

A flaw was found in c-ares. A use-after-free / double-free vulnerability exists in the query-completion handling path, where a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via aresgetaddrinfo over TCP by sending crafte...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: c-ares: c-ares-1.34.7-1.hum1 aarch64, x8664 c-ares-devel-1.34.7-1.hum1 aarch64, x8664 c-ares-1.34.7-1.hum1.src src...

PYSEC-2026-901 Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...

PYSEC-2026-899 protobuf-cpp and protobuf-python have potential Denial of Service issue

Summary A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory OOM failure when processing a specially crafted message, which could lead to a denial of service DoS on services using the libraries. Reporter: ClusterFuzz...

Linux Distros Unpatched Vulnerability : CVE-2026-33630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw a...

[slackware-security] c-ares

New c-ares packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/c-ares-1.34.7-i586-1slack15.0.txz: Upgraded. This release fixes the following security issues: Use-after-free / double-free in c-ares'...

CVE-2026-55380

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile.open read image dimensions from the GD 2.x header and stored them in self.size without calling Image.decompressionbombcheck, allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This iss...

CVE-2026-55380

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile.open read image dimensions from the GD 2.x header and stored them in self.size without calling Image.decompressionbombcheck, allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This iss...

[SECURITY] Fedora 43 Update: mingw-expat-2.8.2-1.fc43

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

CVE-2026-14790 GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference

A flaw has been found in GPAC 26.02.0. This affects the function nhmldumpsendframe of the file src/filters/writenhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be...

CVE-2026-14789

A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local...

RockyLinux 10 : glibc (RLSA-2026:33092)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:33092 advisory. glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width CVE-2026-5450 Bug Fixes and Enhancements: Backport Zen5 IFUNC changes to...

MiracleLinux 8 : glibc-2.28-251.el8_10.38 (AXSA:2026-1182:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1182:06 advisory. glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width CVE-2026-5450 Tenable has extracted the preceding description block...

OPENSUSE-SU-2026:11188-1 json-c-devel-0.19-1.1 on GA media

These are all security issues fixed in the json-c-devel-0.19-1.1 package on the GA media of openSUSE Tumbleweed...

Slackware Linux 15.0 / current c-ares Vulnerability (SSA:2026-187-01)

The version of c-ares installed on the remote host is prior to 1.34.7. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-187-01 advisory. New c-ares packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...