K000162338: PHP vulnerability CVE-2025-6491

Security Advisory Description In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability o...

CVE-2026-26080

HAProxy vulnerability CVE-2026-26080 affects HAProxy Community Edition 3.2.x–3.3.x prior to 3.3.3; HAProxy Enterprise and ALOHA are affected. Root cause: mishandling of varint can cause a loop or crash, leading to DoS. Remediation: upgrade to 3.3.3 or newer (openSUSE/SUSE advisories also referenc...

Important: openvpn

Issue Overview: An attacker controlling an HTTP proxy or performing MITM on the plaintext pre-TLS proxy connection can trigger a single 0-byte overrun to a buffer on the stack by sending a crafted NTLM Type 2 challenge response. CVE-2026-11771 If the active TLS session has a pending dedicated ACK...

PT-2026-61543

Name of the Vulnerable Software and Affected Versions kronosnet versions prior to 1.35 Description The network packet de-fragmentation engine contains a flaw where the internal reassembly code fails to properly validate sequence numbers of incoming payload fragments. An attacker can transmit...

RHEL 9 : webkit2gtk3 (RHSA-2026:42062)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42062 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

CVE-2026-63825

CVE-2026-63825 describes a Linux kernel issue where GCC GCOV instrumentation could merge global counters with loop induction variables, causing inconsistent values and an out-of-bounds write during IPComp processing when inflate_fast() runs on multiple CPUs. The root cause is in the GCOV counter ...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

CVE-2026-9602

Mattermost Desktop App vulnerable versions:

SUSE SLED15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:3030-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3030-1 advisory. This update for glibc fixes the following issues - CVE-2026-5435: unchecked buffer writing in TSIG handling ca...

SUSE SLES12: libwireshark9 / libwiretap7 / libwscodecs1 / libwsutil8 / wireshark / etc (SUSE-SU-2026:2969-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2969-1 advisory. This update for wireshark fixes the following issues - CVE-2026-5401: AFP dissector crash bsc1263756. - CVE-2026-5403: SBC audio codec crash...

SUSE SLED15 / SLES15 Security Update : jq (SUSE-SU-2026:2983-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2983-1 advisory. - CVE-2026-32316: integer overflow within the jvpstringappend and jvpstringcopyreplacebad functions can lead t...

EUVD-2026-44409

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in...

USN-8539-1 gnutls28 vulnerabilities

Haruto Kimura discovered that GnuTLS did not properly apply permitted name constraints in certain certificate validation paths. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. CVE-2026-42011 Oleh Konko discovered that...

Security update for wireshark

This update for wireshark fixes the following issues CVE-2026-5401: AFP dissector crash bsc1263756. CVE-2026-5403: SBC audio codec crash bsc1263765. CVE-2026-5404: K12 RF5 file parser crash bsc1263766. CVE-2026-5406: FC-SWILS dissector crash bsc1263754. CVE-2026-5407: SMB2 dissector infinite loop...

SUSE-SU-2026:2969-1 Security update for wireshark

This update for wireshark fixes the following issues - CVE-2026-5401: AFP dissector crash bsc1263756. - CVE-2026-5403: SBC audio codec crash bsc1263765. - CVE-2026-5404: K12 RF5 file parser crash bsc1263766. - CVE-2026-5406: FC-SWILS dissector crash bsc1263754. - CVE-2026-5407: SMB2 dissector...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SoupWebsocketConnection process. An attacker can cause a crash or forcibly disconnect endpoints by sending an oversized control frame that violates protocol length rules, leadi...

RLSA-2026:38847 Important: nginx:1.24 security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

Vulnerabilities found in Juniper Networks’ Junos OS and Junos OS Evolved

Juniper has identified several vulnerabilities in Junos OS and Junos OS Evolved, specifically related to devices in the MX Series, PTX Series, QFX Series, EX Series, SRX Series, and QFX10000 Series. These vulnerabilities affect various components of Junos OS and Junos OS Evolved, including the...

PT-2026-59795

Impact The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. python import tensorflow as tf @tf.function def test: tf.ra...