Ubuntu 22.04 LTS : Go Networking vulnerabilities (USN-8900-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8900-1 advisory. It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could...

EulerOS 2.0 SP15 : containerd (EulerOS-SA-2026-3902)

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a...

EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-4013)

According to the versions of the qemu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command...

Aruba ClearPass Policy Manager 6.14.x < 6.14.1 Path Traversal (HPESBNW05158)

The version of Aruba ClearPass Policy Manager installed on the remote host is 6.14.x prior to 6.14.1. It is, therefore, affected by a path traversal vulnerability as referenced in the HPESBNW05158 advisory. - An authenticated path traversal vulnerability exists in the command line interface of...

EulerOS 2.0 SP15 : shim (EulerOS-SA-2026-4017)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitivex000D element whose content exceeds 2 gigabytes in length may cause a...

Oracle Linux 8 : vim (ELSA-2026-77359)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-77359 advisory. - RHEL-257017 CVE-2026-73073 arbitrary Ex command execution during C omni-completion - RHEL-253666 CVE-2026-28420 buffer overflow in terminal emulator -...

EulerOS 2.0 SP15 : gzip (EulerOS-SA-2026-3913)

According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

EulerOS 2.0 SP15 : libxml2 (EulerOS-SA-2026-3991)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function...

Rocky Linux 8 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (crlsa-2026_76763)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676763 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorrect...

The vulnerability of the GetSlicers method in the Go language library for reading and writing Excel spreadsheets allows a malicious actor to cause a service failure.

The vulnerability of the GetSlicers method in the Go language library for reading and writing Excel spreadsheets is related to the use of pointers. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-3943)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1...

PT-2026-108311

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The HTTP/2 implementation is lax regarding malformed framing-related headers. When acting as a reverse proxy, the system may forward responses containing these...

The vulnerability of the flatCols() function in the Go language library for reading and writing Excel spreadsheets allows a hacker to cause a service failure.

The vulnerability of the flatCols function in the Go language library for reading and writing Excel spreadsheets is related to uncontrolled memory allocation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2026-108683

Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...

EulerOS 2.0 SP15 : perl-GD (EulerOS-SA-2026-4002)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle.x000D x00...

PT-2026-108156

The image optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentify format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded fil...

PT-2026-108694

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

PT-2026-108688

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...

PT-2026-108317

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A flaw exists where a user working within a malicious project that defines a fake golang.org/fips140 module and utilizes a malicious GOMODPROXY could be served an arbitrary module in place of the...

PT-2026-108203

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string an...