RockyLinux 10 : unbound (RLSA-2026:68291)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:68291 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from the...

Debian dsa-6505 : bind9 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6505 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6505-1 [email protected] https://www.debian.org/securit...

PT-2026-95009

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description Privileged package fetch and cache-cleaning operations use race-prone path handling within libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundle read install pkg.c, libmport/delete...

PT-2026-94531

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the blk-iolatency component where the io.latency controller can throttle a group that lacks its own latency target. This occurs when a sibling misses its target, causi...

PT-2026-94459

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab use-after-free occurs in the IPv6 multicast routing component. When an ingress multicast packet misses the Multicast Forwarding Cache MFC lookup, the ip6mr cache unresolved functi...

Oracle Linux 10 : unbound (ELSA-2026-68291)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-68291 advisory. - Fix CVE-2026-50252: prevent cache poisoning via shared ports - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow - Fix CVE-2026-44690 - Cross-zo...

AlmaLinux 10 : unbound (ALSA-2026:68291)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:68291 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from the...

EulerOS 2.0 SP15 : libsoup (EulerOS-SA-2026-3810)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500330)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500330 advisory. - sctp: prevent peer transport count overflow Asim Viladi Oglu Manizada Orabug: 40036878 CVE-2026-74469 - pppoe: reload header pointer after...

SUSE CVE-2026-9679

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 5.4 does not specify any decoding and browsers do not decode either. Applications that parse a...

unbound: Unbound: DNS cache poisoning via UDP source port predictability

A flaw in Unbound's SOREUSEPORT implementation reduces UDP source port entropy by allowing attackers to map ports to specific worker threads. This enables DNS cache poisoning, potentially leading to traffic redirection or unauthorized information disclosure...

Moderate: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-77360

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

CVE-2026-77360

oRPC is a tool for building type-safe APIs adhering to OpenAPI standards. Prior to 1.14.8 , the @orpc/server CORS plugin (packages/server/src/plugins/cors.ts) copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin fo...

CVE-2026-77360 oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into the response instead of controlling Vary as a response-only...

Moderate: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

unbound: Unbound: DNS cache poisoning via UDP source port predictability

A flaw in Unbound's SOREUSEPORT implementation reduces UDP source port entropy by allowing attackers to map ports to specific worker threads. This enables DNS cache poisoning, potentially leading to traffic redirection or unauthorized information disclosure...

CVE-2026-69147 vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set mediaiokwargs.video.videobackend to pynvvideocodec, and MediaConnector.fetchvideo forwards that choice to VideoMediaIO even when startup configuration...