18131 matches found
OESA-2026-1973 giflib security update
giflib is a library of gif images and provides utilities for processing images. Security Fixes: Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but...
OESA-2026-1974 giflib security update
giflib is a library of gif images and provides utilities for processing images. Security Fixes: Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but...
Linux Distros Unpatched Vulnerability : CVE-2026-21726
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files ...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007267)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007267 advisory. In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix double module refcount decrement Once the discipline is associated with the device...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007522)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007522 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring: fix ltout double free on completion race Always remove linked timeout on iolinktimeoutfn...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007491)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007491 advisory. In the Linux kernel, the following vulnerability has been resolved: class: fix possible memory leak in classregister If classaddgroups returns error, the 'cp-subsys'...
Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-007624)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007624 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in userclusterconnect userclusterdisconnect frees conn-ccprivate which is ...
[slackware-security] libxml2
New libxml2 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libxml2-2.11.9-i586-9slack15.0.txz: Rebuilt. This update fixes security issues: entities: copy children in xmlCopyEntity. c14n: Fix...
Mako: Path traversal via double-slash URI prefix in TemplateLookup
Summary TemplateLookup.gettemplate is vulnerable to path traversal when a URI starts with // e.g., //../../../secret.txt. The root cause is an inconsistency between two slash-stripping implementations: - Template.init strips one leading / using if/slice - TemplateLookup.gettemplate strips all...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the gettemplate function. An attacker can access arbitrary files readable by the process by supplying a specially crafted URI with a double-slash prefix, which bypasses path normalization checks. Note: This is...
GHSA-V92G-XGXW-VVMM Mako: Path traversal via double-slash URI prefix in TemplateLookup
Summary TemplateLookup.gettemplate is vulnerable to path traversal when a URI starts with // e.g., //../../../secret.txt. The root cause is an inconsistency between two slash-stripping implementations: - Template.init strips one leading / using if/slice - TemplateLookup.gettemplate strips all...
Security update for shim
This update for shim fixes the following issues: shim is updated to version 16.1: shimstartimage: fix guid/handle pairing when uninstalling protocols Fix uncompressed ipv6 netboot fix test segfaults caused by uninitialized memory SbatLevelVariable.txt: minor typo fix. Realloc needs to allocate on...
Exploit for CVE-2026-33824
Windows IKEv2 Double-Free RCE CVE-2026-33824 Remote code ex...
PT-2026-38560
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When using the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory, leading to a crash. This occurs specifically when utilizing th...
PT-2026-34725
Name of the Vulnerable Software and Affected Versions Mako versions prior to 1.3.11 Description Mako is a template library written in Python. The get template function within TemplateLookup is susceptible to path traversal when a URI begins with //. This occurs due to an inconsistency between two...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-007173)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007173 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, railwindowfree dereferences a freed xfAppWindow pointer during HashTableFre...
RHEL 10 : kernel (RHSA-2026:8342)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:8342 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Local denial of...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : giflib (SUSE-SU-2026:1338-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1338-1 advisory. This update for giflib fixes the following issue: - CVE-2026-23868: double-free result of a shallow copy...
EUVD-2026-23100
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/namespace Thanks to Prasanth Sundararajan for reporting this vulnerability...
Grafana Loki Path Traversal - CVE-2021-36156 Bypass
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/namespace Thanks to Prasanth Sundararajan for reporting this vulnerability...