RLSA-2026:55784 Important: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 For more details about the security issues, including the impact, a CVSS...

Insecure Directory Permissions

org.springframework.data, spring-data-geode is vulnerable to Insecure Directory Permissions. The vulnerability is due to snapshot archives being extracted into predictable, permissive directories under the system temporary location, which allows a local attacker with basic privileges on a shared...

SUSE CVE-2026-73089

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct queries, context result in cache and every parseQueries AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who...

PT-2026-77274

Name of the Vulnerable Software and Affected Versions Kraken affected versions not specified Description Kraken agents do not verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing them to the content-addressable cache. Instead, the system relies solely on...

PT-2026-76992

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A mitigation bypass...

PT-2026-76987

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description Information disclosure occurs due to a side-channel in the Storage: Cache API component. A...

CVE-2026-74959: Protection Mechanism Failure

Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

PT-2026-77311

Name of the Vulnerable Software and Affected Versions fastify versions 5.8.3 through 5.12.0 Description An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the trustProxy setting is configured with a numeric hop-count...

RockyLinux 8 : unbound (RLSA-2026:55784)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55784 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-72451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock...

AlmaLinux 9 : unbound (ALSA-2026:55841)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55841 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Service...

AlmaLinux 10 : unbound (ALSA-2026:55892)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55892 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Service...

CVE-2026-16732: Use of Less Trusted Source

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

CVE-2026-74954: Observable Discrepancy

Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

AlmaLinux 8 : unbound (ALSA-2026:55784)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:55784 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding descripti...

RockyLinux 10 : unbound (RLSA-2026:55892)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55892 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Servic...

MiracleLinux 8 : bind9.16-9.16.23-0.22.el8_10.12 (AXSA:2026-1555:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1555:03 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

Linux Distros Unpatched Vulnerability : CVE-2026-72239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert Drop WBINVD before setting MSRAMD64SYSCFGSNPEN Revert 99cf1fb58e68...

Amazon Linux 2023 : nodejs24, nodejs24-devel, nodejs24-full-i18n (ALAS2023-2026-2059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2059 advisory. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attack...

RHEL 10 : unbound (RHSA-2026:55892)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55892 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Cache poisonin...