nginx 1.30.x < 1.30.4 / 1.31.2 < 1.31.3 Multiple Vulnerabilities

According to its Server response header, the installed version of nginx is 1.30.0 prior to 1.30.4, or 1.31.2 prior to 1.31.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string...

CVE-2026-60311

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 9.0.0-9.7.1; MySQL Cluster: 9.0.0-9.7.1. Easily exploitable vulnerability allows low privilege...

CVE-2026-61109

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

CVE-2026-60182

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

Linux Distros Unpatched Vulnerability : CVE-2026-60191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...

AZL-93764 CVE-2026-64474 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64385

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...

CVE-2026-64359

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

CVE-2026-64324

In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udffreeblocks checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the...

CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64292

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

openSUSE 16: avahi / avahi-autoipd / avahi-compat-howl-devel / etc (openSUSE-SU-2026:21417-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21417-1 advisory. - CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451. Changes for avahi: - Make /var/lib/avahi-autoipd ...

Fedora 44 : skopeo (2026-9b2e56edf5)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9b2e56edf5 advisory. Security fix for CVE-2026-27145 Go stdlib crypto/x509 DoS vulnerability. Rebuild with golang-1.26.5 which includes the fix. Tenable has extracted the precedi...

openSUSE 16 Security Update : perl-DBI (openSUSE-SU-2026:21412-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21412-1 advisory. - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the...

GHSA-HMJ8-5XMH-5573 libp2p: yamux connection DoS via oversized data frame

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.akolov:doorman-core_2.12 (0.0.5) +148 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-server_2.12 (>=0.15.0a, <=1.0-234-d1a2b53)

org.http4s:http4s-blaze-server2.12 MAVEN version =0.15.0a, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.13, =0.0.13, =0.0.30 and more Source cves: CVE-2026-73493 Source advisory: SNYK:JAVA-ORGHTTP4S-18313134...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.8.0-rc6), com.47deg:embedded-cassandra-core_2.12 (0.0.7) +231 more potentially affected by CVE-2026-73493 via org.http4s:http4s-blaze-core_2.12 (>=0.10.0-m10, <=1.0-234-d1a2b53)

org.http4s:http4s-blaze-core2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.19.3 and more Source cves: CVE-2026-73493 Source advisory: SNYK:JAVA-ORGHTTP4S-18313135...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-14257 via brace-expansion (>=2.0.0, <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-14257 Source advisory: OSV:GHSA-MH99-V99M-4GVG...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2935 more potentially affected by CVE-2026-14257 via brace-expansion (>=4.0.0, <=5.0.7)

brace-expansion NPM version =4.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...