3287 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-72180
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd...
AlmaLinux 10 : libssh (ALSA-2026:55855)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised chann...
RockyLinux 10 : libssh (RLSA-2026:55855)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55855 advisory. libssh: libssh: information disclosure via short GSSAPI Curve25519 public key CVE-2026-59842 libssh: libssh: denial of service via zero advertised...
RHEL 10 : libssh (RHSA-2026:55855)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55855 advisory. libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh:...
libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...
JLSEC-2026-1339
A user can tell curl = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server --ssl-reqd on the command line orCURLOPTUSESSL set to CURLUSESSLCONTROL or CURLUSESSLALL withlibcurl. This requirement could be bypassed if the server would return a...
BIT-CONSUL-2026-19012 Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a...
CVE-2026-72887
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
CVE-2026-72887
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
CVE-2026-72887
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
EUVD-2026-59987
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
CVE-2026-72887 Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
CVE-2026-72887
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits...
CVE-2026-72887
The Net::OAuth::Client component in Perl (versions before 0.32 ) is vulnerable to a silent downgrade from OAuth 1.0a to OAuth 1.0 during the get_request_token process. If a callback is provided to the constructor to select OAuth 1.0a, the library revokes this choice without warning if the respons...
Linux Distros Unpatched Vulnerability : CVE-2026-72887
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken. Passing a callback...
PT-2026-73167
Name of the Vulnerable Software and Affected Versions Net::OAuth::Client versions prior to 0.32 Description Net::OAuth::Client allows a service provider to silently downgrade OAuth 1.0a to OAuth 1.0 within the get request token function. When a callback is passed to the constructor, OAuth 1.0a is...
CVE-2026-72180
CVE-2026-72180 affects the Linux kernel’s huge memory handling (mm/huge_memory). The root cause is that during device-private PMD downgrade, the pmd_swp_uffd_wp flag can be lost when the swap entry is rewritten, allowing a plain mprotect() on a UFFD_WP-marked device-private THP to strip the flag ...