AlmaLinux 10 : skopeo (ALSA-2026:64818)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64818 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 encoding/asn1: golang: Go encoding/asn1: Denial of...

SUSE CVE-2026-80882

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...

CVE-2026-80057

Dell Secure Connect Gateway (SCG) 5.0 contains a Use of Hard-coded Cryptographic Key vulnerability in Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00. A low-privileged attacker with local access can exploit this to achieve information disclosure (high confident...

Linux Distros Unpatched Vulnerability : CVE-2026-80882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM...

The vulnerability of the acomp_save_req() function in the crypto/acompress.c module of the Linux kernel’s cryptographic subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the acompsavereq function in the crypto/acompress.c module of the Linux kernel cryptographic subsystem relates to access to resources through incompatible types. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the atmel_sha204a_remove() function in the drivers/crypto/atmel-sha204a.c driver of the Linux kernel cryptographic accelerator module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the atmelsha204aremove function in the drivers/crypto/atmel-sha204a.c driver for the Linux kernel cryptographic accelerator is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a...

Linux Distros Unpatched Vulnerability : CVE-2026-57162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053434)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053434 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053299)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053299 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - add param check for DH Reject requests with a source buffer that is bigger than the...

Malicious code in eth-query-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a24a29ae503dbb2bc291fcbd2d7eafdc92a6927a9a91bbda677e9b9b9b8c22 Package presents itself as an Ethereum RPC query helper but src/envcheck.cjs walks the caller's project tree on first use of the advertised...

Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

...

SUSE CVE-2026-80831

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxsdcpaesblockcrypt uses sgdmalen without mapping the source scatterlist with dmamapsg first. Therefore, sgdmalen is invalid and could return zero or a stale DMA length,...

SUSE CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

RLSA-2026:63124 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME head...

AlmaLinux 10 : grafana-pcp (ALSA-2026:63119)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:63119 advisory. mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go encoding/asn1: Denial of Servi...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-32280 DESCRIPTION: During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are...

GHSA-H4V5-CRX2-3CV4 SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72793. Summary /api/system/getConf is registered with CheckAuth only and is reachable by the publish RoleReader token, and anonymously when Publish.Auth.Enable is false. Its non-administrator masking chain is a blocklist that enumerates fields...

DEBIAN-CVE-2026-57162

PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer sdesencodesdp in transportsrtpsdes.c. This affects applications with...

CVE-2026-80882

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm Ensure the ENOMEM error value is set when the input buffer allocation fails in tegraccmdoonereq...