RHEL 9 : mod_md (RHSA-2026:57642)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57642 advisory. This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate...

PT-2026-79097

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incomplete frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

PT-2026-79138

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

Linux Distros Unpatched Vulnerability : CVE-2026-71141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

PT-2026-79204

Name of the Vulnerable Software and Affected Versions Mailpit versions 1.30.0 through 1.30.4 Description An unauthenticated SMTP client can cause substantial memory pressure by sending a single line that exceeds the configured MaxMessageSize. This occurs because the readData function in...

Oracle Linux 10 : perl-Date-Manip (ELSA-2026-56971)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-56971 advisory. 6.94-5.1 - Fix CVE-2026-60075: prevent quadratic-cost regex DoS in date/time parsing by rejecting overly long input strings Resolves: RHEL-239790 Tenable has...

Security update for forgejo-cli (important)

openSUSE security update: security update for forgejo-cli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21605-1 Rating: important References: bsc1242683 bsc1248047 bsc1274529 Cross-References: CVE-2025-3416 CVE-2025-55159 CVE-2026-25541 CVSS score...

bind9: bind: Potential wildcard CNAME RPZ policy bypass

A flaw was found in BIND 9, a widely used Domain Name System DNS software. A remote attacker could exploit this by sending specially crafted, excessively long DNS queries. This could bypass Response Policy Zone RPZ rules, which are designed to block access to malicious domains, and potentially...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...

bind: BIND: Denial of Service via specially crafted DNS messages

A flaw was found in the bind component, specifically within the named daemon. This vulnerability allows a remote attacker to send specially crafted Domain Name System DNS messages. These messages, which use unusual classes or meta-classes, can trigger assertion failures in the named daemon when...

DEBIAN-CVE-2026-76924

Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

DEBIAN-CVE-2026-76928

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

DEBIAN-CVE-2026-76918

SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76887

Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76880

RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76928

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76924 Out-of-bounds Read in Wireshark

Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76889

Wireshark's UMTS FP protocol dissector crashes in versions 4.6.0–4.6.7 and 4.4.0–4.4.18, causing denial of service; CVSS 4.7 MEDIUM with local attack vector. No patch version or exploitation evidence is provided in the documents.

CVE-2026-76882 Out-of-bounds Read in Wireshark

Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-76881

Wireshark's CMS protocol dissector crashes via a null pointer dereference in versions 4.6.0–4.6.7 and 4.4.0–4.4.18, enabling denial of service. CVSS 4.7 (MEDIUM) requires local access and user interaction. Fix: upgrade to 4.6.8 or 4.4.19 per wnpa-sec-2026-76. No exploitation details provided.