CVE-2026-7768

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the...

CVE-2026-7768 @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth

@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy. A remote unauthenticated client could send many distinct but matching Accept header variants to make the cache grow unbounded, eventually exhausting the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013191)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013191 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpflrulist KCSAN reported a data-race when accessing node-ref...

CVE-2026-27980 Next.js: Unbounded next/image disk cache growth can exhaust storage

Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache /next/image did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many...

CVE-2026-27980

Next.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache /next/image did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many...

OSEC-2026-02 ARP unbounded memory usage

Background Mirage's implementation of the ARP protocol RFC826 caches ARP replies to construct an IPv4 address - MAC address cache. This cache is long-lived effectively global, and also contains pending ARP requests, which are replaced by the reply, or deleted after a timeout. ARP replies that do...

Fedora 43 : rust-lru (2026-cd2a3ce9e6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cd2a3ce9e6 advisory. Update to version 0.16.3. Includes the fix for RUSTSEC-2026-0002. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora: Security Advisory (FEDORA-2026-cd2a3ce9e6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : rust-lru (2026-e153bc6b6a)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e153bc6b6a advisory. Update to version 0.16.3. Includes the fix for RUSTSEC-2026-0002. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora: Security Advisory (FEDORA-2026-e153bc6b6a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: A divide-by-zero error was avoided in damonlrusortapplyparameters. Patch series “mm/damon: Avoid divide-by-zero in DAMON module’s parameter application”. The RECLAIM and LRUSORT modules of DAMON do not perform a...

actix-web-csp (0.1.0), adguard-tui (>=0.9.0, <=1.5.0) +652 more potentially affected by unknown CVE via lru (>=0.9.0, <=0.15.0)

lru CARGO version =0.9.0, =0.9.0, =0.0.24, =0.0.23, =0.1.0, =1.0.0, =0.4.0, =0.1.0, =0.1.0, =0.1.3, =0.3.1 - anni-repo 0.4.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RHFX-M35P-FF5J...

actix-web-csp (0.1.0), adguard-tui (>=0.9.0, <=1.5.0) +652 more potentially affected by unknown CVE via lru (>=0.9.0, <=0.15.0)

lru CARGO version =0.9.0, =0.9.0, =0.0.24, =0.0.23, =0.1.0, =1.0.0, =0.4.0, =0.1.0, =0.1.0, =0.1.3, =0.3.1 - anni-repo 0.4.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0002...

SUSE CVE-2023-54165

In the Linux kernel, the following vulnerability has been resolved: zsmalloc: move LRU update from zsmapobject to zsmalloc Under memory pressure, we sometimes observe the following crash: 5694.832838 ------------ cut here ------------ 5694.842093 listdel corruption, ffff888014b6a448-next is...

SUSE CVE-2023-54283

In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpflrulist KCSAN reported a data-race when accessing node-ref. Although node-ref does not have to be accurate, take this chance to use a more common READONCE and WRITEONCE pattern instead of datarace...

Linux Distros Unpatched Vulnerability : CVE-2023-54283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Address KCSAN report on bpflrulist KCSAN reported a data-race when accessing node-ref. Although node-ref does not have to be accurate, take this chance to...

EUVD-2023-60521

In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpflrulist KCSAN reported a data-race when accessing node-ref. Although node-ref does not have to be accurate, take this chance to use a more common READONCE and WRITEONCE pattern instead of datarace...

EUVD-2023-60476

In the Linux kernel, the following vulnerability has been resolved: zsmalloc: move LRU update from zsmapobject to zsmalloc Under memory pressure, we sometimes observe the following crash: 5694.832838 ------------ cut here ------------ 5694.842093 listdel corruption, ffff888014b6a448-next is...

CVE-2023-54283

In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpflrulist KCSAN reported a data-race when accessing node-ref. Although node-ref does not have to be accurate, take this chance to use a more common READONCE and WRITEONCE pattern instead of datarace...

CVE-2023-54165

In the Linux kernel, the following vulnerability has been resolved: zsmalloc: move LRU update from zsmapobject to zsmalloc Under memory pressure, we sometimes observe the following crash: 5694.832838 ------------ cut here ------------ 5694.842093 listdel corruption, ffff888014b6a448-next is...