SUSE-SU-2026:23011-1 Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged allocation...

SUSE-SU-2026:23081-1 Security update for the Linux Kernel (Live Patch 23 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged allocation...

CVE-2026-66754 Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

ALPINE-CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

AZL-94299 CVE-2026-6879 affecting package python3 for versions less than 3.12.9-14

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

DEBIAN-CVE-2026-59878

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done...

CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

ALPINE-CVE-2026-62427

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

ALPINE-CVE-2026-62426

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

ALPINE-CVE-2026-42492

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XENDOMCTLgetdomainstate was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQDOMEXC virtual IRQ...

ALPINE-CVE-2026-42493

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives HVM/PVH: HAP, PV: shim are commonly available, the decision was to deprecate the functionality, while still retainin...

CVE-2026-63301 Denial of Service in Quick.CMS

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

libreswan security update

An update is available for libreswan. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the...

RockyLinux 10 : libreswan (RLSA-2026:46398)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:46398 advisory. librenswan: IKEv1 Denial of Service via RSA-SHA1 PKCS1 Version 1.5 Encrypted authentication payload CVE-2026-50721 librenswan: IKEv2 Denial of Service...

ALSA-2026:47058 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malform...

TencentOS Server 3: python3.12 (TSSA-2026:0768)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0768 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

RockyLinux 8 : nodejs:24 (RLSA-2026:47060)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47060 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

RHEL 8 : nodejs:24 (RHSA-2026:47060)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47060 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2026-64695

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory...