Oracle Linux 9 : curl (ELSA-2026-69126)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69126 advisory. - add sasl service name to connection reuse checks CVE-2026-8458 Tenable has extracted the preceding description block directly from the Oracle Linux...

RHEL 9 : curl (RHSA-2026:69126)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69126 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including...

CVE-2026-55074: Improper Link Resolution Before File Access

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

ALSA-2026:69126 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

curl security update

7.76.1-40.el98.7 - add sasl service name to connection reuse checks CVE-2026-8458 7.76.1-40.el98.6 - detect proxy changes read from environment CVE-2026-8927...

EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-3830)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even...

OPENSUSE-SU-2026:21894-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

OPENSUSE-SU-2026:21888-1 Security update for gnome-remote-desktop

This update for gnome-remote-desktop fixes the following issue: - CVE-2026-18358: system-mode RDP server missing connection throttling can allow unauthenticated denial of service bsc1273354...

Fedora 43 : opkssh (2026-38b019a0f0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-38b019a0f0 advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...

Fedora 44 : opkssh (2026-f7b73f165d)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f7b73f165d advisory. Update the bundled golang.org/x/crypto to v0.56.0, which fixes CVE-2026-56855 and CVE-2026-78662 denial of service via crafted channel messages in...

CVE-2026-82672

CVE-2026-82672 is an HTTP Request/Response Smuggling vulnerability in the Elixir mint HTTP/1 client library (versions 0.1.0 through before 1.10.1). The root cause lies in Mint.HTTP1.Parse.chunk_size/1, which stops parsing a chunked response's chunk-size line at the first non-hexadecimal byte and ...

EEF-CVE-2026-82672 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent request...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3717)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-3687)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3764)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

CVE-2026-92757

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

Security Bulletin: Vulnerable Version of Software in Use

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2026-1965 DESCRIPTION: libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features...

Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757 Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...