SUSE-SU-2026:23912-1 Security update for expat

This update for expat fixes the following issues: - CVE-2026-41080: crafted XML document can cause a denial of service bsc1262263. - CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XM...

unbound security update

An update is available for unbound. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unbound packages provide a validating, recursive, and caching DNS or DNSS...

RLSA-2026:70754 Critical: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis CVE-2026-82717 unbound: Unbound: Heap buffer overflow via malicious DNSSEC response CVE-2026-81634 unbound: Unbound:...

thunderbird: Information disclosure due to malicious IMAP server response

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js...

CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

CVE-2026-88378

The QuickJS engine (commit 04be24600) is affected by a heap out-of-bounds write condition located in the JS_ReadFunctionTag() function. This vulnerability is present in various Linux distributions, though some sources indicate that a vendor-supplied patch may not be available for certain impacted...

CVE-2026-88378: Undefined Security Weakness

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

EUVD-2026-86272

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

CVE-2026-88378

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

CVE-2026-88351

An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpacktreeparsechildren can overflow sizet and...

RHEL 10 : glib2 (RHSA-2026:71404)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71404 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, t...

RHEL 10 : libxml2 (RHSA-2026:71586)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71586 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2:...

MiracleLinux 9 : openexr-3.1.1-3.el9_8.4 (AXSA:2026-1902:06)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1902:06 advisory. OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files CVE-2026-68515 Tenable has extracted the preceding description block directl...

SUSE SLES12: libblkid-devel / libblkid1 / libblkid1-32bit / libfdisk1 / etc (SUSE-SU-2026:4296-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4296-1 advisory. - CVE-2026-13595: heap use-after-free in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU in the mount progra...

RHEL 10 : gstreamer1-plugins-good (RHSA-2026:71650)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71650 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages...

ALSA-2026:71608 Important: perl-DBI security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: DBI for Perl: Heap...

Fedora 43 : 389-ds-base (2026-0b8bc362b1)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0b8bc362b1 advisory. - Resolves: rhbz2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer...

RHEL 9 : unbound (RHSA-2026:71460)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71460 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Heap buffer overflow and...