PT-2026-60379

Name of the Vulnerable Software and Affected Versions affected versions not specified Description When used with the permessage-deflate extension, a WebSocket server or client may accept messages exceeding the configured maximum size. This occurs because the size limit is validated against the...

PT-2026-60296

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.61 Description An issue exists in the @nocobase/plugin-notification-in-app-message where the 'GET /api/myInAppChannels:list' endpoint is exposed. A signed-up authenticated user can exploit this by providing a val...

Windows SMB Privilege Escalation

The vulnerability of the SMB protocol implementation in Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

AlmaLinux 10 : corosync (ALSA-2026:19043)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:19043 advisory. corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet CVE-2026-35091 corosync: Corosync: Denial of Service via integer...

pacemaker security update

2.1.7-5.6.0.1 - Upstream reference in pacemaker crmreport binary Orabug: 32825154 - Replace bug url Orabug: 34202300 2.1.7-5.6 - Fix integer overflows in remote message decompression code CVE-2026-10649 - Resolves: RHEL-181157...

RockyLinux 9 : pacemaker (RLSA-2026:39323)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39323 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description block...

RHEL 8 : pacemaker (RHSA-2026:39322)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39322 advisory. The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in t...

RHEL 9 : pacemaker (RHSA-2026:39323)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39323 advisory. The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in t...

AlmaLinux 8 : pacemaker (ALSA-2026:39322)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39322 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description block...

JLSEC-2026-737 TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...

TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...

JLSEC-2026-743 When `HAVE_ENCRYPT_THEN_MAC` is configured, the implementation could fall back to MAC-then-Encrypt...

When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC...

JLSEC-2026-718 Heap buffer overflow in DTLS 1.3 ACK message processing

Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow...

JLSEC-2026-744 Heap buffer overread in `wc_PKCS7_DecodeEnvelopedData` when parsing crafted PKCS7 EnvelopedData

Heap buffer overread in wcPKCS7DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS...

EUVD-2026-44367

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier...

EUVD-2026-44462

NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to code execution...

CVE-2026-48069 @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in...

CVE-2026-48069

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in...

CVE-2026-15058

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier...

Important: Red Hat Security Advisory: pacemaker security update

An update for pacemaker is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial...