EUVD-2026-100747

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with unsupported or non-canonical HTTP methods to an existing static path. Because the application encounters an unhandled panic before authentication is evaluated, these...

Linux Distros Unpatched Vulnerability : CVE-2026-101025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not...

Unity Linux 20.1070a Security Update: libssh (UTSA-2026-130144)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130144 advisory. A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc (CENTOS8.4:CLSA-2026:1791965784)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791965784 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130154)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130154 advisory. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Tenable has extracted the preceding description block...

MiracleLinux 9 : kernel-5.14.0-687.46.1.el9_8 (AXSA:2026-2036:97)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2036:97 advisory. kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation CVE-2026-43133 kernel: ipv6: prevent possible UaF in addrconfpermanentaddr...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130078)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130078 advisory. An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can...

Linux Distros Unpatched Vulnerability : CVE-2026-98411

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: sequencing: fix NULL-pointer dereference in pwrseqdeviceregister If devsetname fails in pwrseqdeviceregister, we jump to the errputpwrseq label before...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130084)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130084 advisory. FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdisurfacebits when processing Surface Bits commands with NSCodec codec ID. A malicious RD...

Linux Distros Unpatched Vulnerability : CVE-2026-110602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajdopen in mspack/kwajd.c that frees unzeroed filename and extra pointers ...

Linux Distros Unpatched Vulnerability : CVE-2026-109946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion an...

Linux Distros Unpatched Vulnerability : CVE-2026-97205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations,...

Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130112)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130112 advisory. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a maliciou...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130135)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130135 advisory. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a maliciou...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1791984617)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791984617 advisory. - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libx11 vulnerabilities (USN-8913-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8913-1 advisory. Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard map...

CVE-2026-110257: Memory Allocation with Excessive Size Value

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110659: NULL Pointer Dereference

ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocationsectionaccessor getentry that allows attackers to crash applications via an unvalidated shlink index. Attackers can supply a crafted ELF file whose SHTREL or SHTRELA section has a dangling shlink, causing...