OESA-2026-4008 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A flaw was found in libsoup's WebSocket implementation when using...

Security update for 389-ds (critical)

openSUSE security update: security update for 389-ds ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21950-1 Rating: critical References: bsc1273133 bsc1279572 bsc1279864 bsc1279865 bsc1279866 bsc1279867 Cross-References: CVE-2026-11770 CVE-2026-183...

CVE-2026-97957: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLEN 48. However, this allows the last segment seqid=42 to carry a full...

PT-2026-98621

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow check mbox seq id and seg len validates that seq id does not exceed SEQ ID MAX VAL 42 and seg len does not exceed MBOX SEG LEN 48. However, this allows the last segment seq id=42 to...

CVE-2026-97957

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLEN 48. However, this allows the last segment seqid=42 to carry a full...

SUSE SLES15 Security Update : freerdp (SUSE-SU-2026:1129-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1129-1 advisory. - CVE-2026-26271: Buffer Overread in FreeRDP Icon Processing bsc1258979. - CVE-2026-26955: Out-of-bounds Write in freerdp bsc1258982. -...

Linux Distros Unpatched Vulnerability : CVE-2026-88351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32...

PT-2026-99001

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http v3 module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner...

openSUSE 16: gdk-pixbuf-loader-libheif / libheif-aom / libheif-dav1d / etc (openSUSE-SU-2026:21889-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21889-1 advisory. - CVE-2026-84383: Heap buffer overflow in scalenearestneighbor via duplicate alpha planes from nested iden/auxl items bsc1279443. -...

CVE-2025-14181: Integer Overflow or Wraparound

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

Linux Distros Unpatched Vulnerability : CVE-2026-96746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the...

Linux Distros Unpatched Vulnerability : CVE-2026-88830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-88832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

LibreOffice < 26.2.5 Multiple Vulnerabilities

The version of LibreOffice installed on the remote host is prior to 26.2.5. It is, therefore, affected by multiple vulnerabilities: - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the...

PT-2026-99116

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The SOAP HTTP client contains a flaw in how it manages response buffer growth. The system uses a check based on signed integer overflow, which is considered...

Linux Distros Unpatched Vulnerability : CVE-2026-97957

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLE...

Fedora 46 : ntfs-3g / ntfs-3g-system-compression / partclone / testdisk / etc (2026-a2beb6a664)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-a2beb6a664 advisory. ntfs-3g changes: Guard against multiple creator-owner and creator-group ACEs during ACL inheritance. ntfscat Fix missing cleanup of opened attribute on error...

Oracle Linux 8 : unbound (ELSA-2026-70754)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70754 advisory. - Prevent heap corruption during CNAME synthesis CVE-2026-82717 - Prevent heap buffer overflow when digesting DNSKEY CVE-2026-81642 - Prevent heap...

RHEL 8 : unbound (RHSA-2026:72110)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72110 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Heap buffer overflow and...

RockyLinux 9 : unbound (RLSA-2026:71487)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71487 advisory. unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis CVE-2026-82717 unbound: Unbound: Heap buffer overflow via malicious DNSSEC...