CVE-2026-16732: Use of Less Trusted Source

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

CVE-2026-74954: Observable Discrepancy

Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Linux Distros Unpatched Vulnerability : CVE-2026-72154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d openrisc: Add jump labe...

RockyLinux 8 : unbound (RLSA-2026:55784)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55784 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding...

AlmaLinux 8 : unbound (ALSA-2026:55784)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:55784 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 Tenable has extracted the preceding descripti...

Linux Distros Unpatched Vulnerability : CVE-2026-72239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert Drop WBINVD before setting MSRAMD64SYSCFGSNPEN Revert 99cf1fb58e68...

PT-2026-77274

Name of the Vulnerable Software and Affected Versions Kraken affected versions not specified Description Kraken agents do not verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing them to the content-addressable cache. Instead, the system relies solely on...

RockyLinux 10 : unbound (RLSA-2026:55892)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55892 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Servic...

RockyLinux 9 : unbound (RLSA-2026:55841)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55841 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of Service...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101971)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101971 advisory. In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTORAW MUST drop incoming ICMP Yizhou Zhao reported that simply havi...

unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes

A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibli...

Important: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes

A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibli...

ANT-2026-H4RM2RMD · htslib · Out-of-Bounds Access

oob-read medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-H4RM2RMD: Out-of-bounds access in CRAM xpack/xrle...

Important: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes

A flaw was found in Unbound. Insufficient validation of the RRSIG.Labels field, combined with premature cache writes during RFC 8198 aggressive NSEC processing, can lead to cache poisoning. This vulnerability allows a malicious actor, controlling a single delegated zone, to poison arbitrary sibli...

GHSA-8C42-7QJ2-3J46 Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Summary Netty's CorsHandler silently overwrites existing Vary headers, enabling cache poisoning and sensitive information disclosure. Details io.netty.handler.codec.http.cors.CorsHandlersetVaryHeader overwrites any existing Vary headers set by backend applications. java private static void...

Use of Cache Containing Sensitive Information

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information due to the setVaryHeader method in...

Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Summary Netty's CorsHandler silently overwrites existing Vary headers, enabling cache poisoning and sensitive information disclosure. Details io.netty.handler.codec.http.cors.CorsHandlersetVaryHeader overwrites any existing Vary headers set by backend applications. java private static void...