366158 matches found
Security update for mbedtls-2 (important)
openSUSE security update: security update for mbedtls-2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21864-1 Rating: important References: bsc1245810 bsc1252454 Cross-References: CVE-2025-52496 CVE-2025-59438 CVSS scores: CVE-2025-59438 SUSE : 5....
Security update for MozillaFirefox (important)
openSUSE security update: security update for mozillafirefox ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21853-1 Rating: important References: bsc1278001 Cross-References: CVE-2026-74952 CVE-2026-75874 CVE-2026-84118 CVE-2026-84119 CVE-2026-8412...
EulerOS 2.0 SP15 : dracut (EulerOS-SA-2026-3802)
According to the versions of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic...
CVE-2026-90366: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...
EulerOS 2.0 SP15 : openssl (EulerOS-SA-2026-3812)
According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A signed integer overflow when sizing the destinationx000D buffer for Unicode output in ASN1mbstringncopy can lead to a heapx000D...
EulerOS 2.0 SP15 : openssl (EulerOS-SA-2026-3787)
According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A signed integer overflow when sizing the destinationx000D buffer for Unicode output in ASN1mbstringncopy can lead to a heapx000D...
MiracleLinux 8 : [security - medium] perl:5.32, perl-URI-1.76-5.module+el8+2046+99ea20f7, perl-version-0.99.29-1.module+el8+2046+99ea20f7 (AXSA:2026-1870:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1870:01 advisory. perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 Tenable has extracted the preceding description block direct...
CVE-2026-90181: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure ublkshmemremoveranges removes matching maple tree ranges in batches, but first stores each range into a temporary xarray so that the pages can be unpinned after droppin...
CVE-2026-52483
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...
EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-3824)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave in...
EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-3799)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave in...
MiracleLinux 9 : vim-8.2.2637-26.el9_8.21.ML.1 (AXSA:2026-1861:24)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1861:24 advisory. vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Servic...
CVE-2026-93337: Improper Neutralization of Argument Delimiters in a Command
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit...
CVE-2026-61700: Improper Access Control
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...
CVE-2026-52483: Undefined Security Weakness
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...
CVE-2026-92993: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...
CVE-2026-92992: Missing Authorization
A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...
CVE-2026-55062: Improper Limitation of a Pathname to a Restricted Directory
uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...
CVE-2026-90412: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...
CVE-2026-90228: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...