RHEL 9 : nginx:1.26 (RHSA-2026:59496)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59496 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage...

Dotnetnuke < 10.3.3 Server-Side request forgery in journal module (GHSA-hmwm-c2hx-wmxh)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A server-side request forgery SSRF vulnerability in the Journal module could allow an authenticated user to cause the server to...

Dotnetnuke < 10.3.3 Permission precedence flaw in module permissions (GHSA-hqgc-qj63-mx24)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A permission evaluation flaw could allow users with page-level content permissions to access module management features despite...

Linux snd_pcm_attach_substream Buffer Overflow DoS

The vulnerability of the sndpcmattachsubstream function in the sound/core/pcm.c module, which is part of the Linux kernel’s audio card support mechanism, is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel video buffer driver Heap Buffer Overflow DoS

The vulnerability of the driver module/video/fbdev/smscufx.c driver for kernel-based Linux device buffer devices is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

S390 gmap_helper_zap_one_page Heap Buffer Overflow

The vulnerability of the gmaphelperzaponepage function in the arch/s390/mm/gmaphelpers.c module, which is part of the S390 platform support for Linux operating systems, stems from insufficient checks for unusual or exceptional states. Exploiting this vulnerability could allow an attacker to...

net rxrpc rxgk.c Heap Buffer Overflow DoS

The vulnerability of the rxgkverifyauthenticator function in the net/rxrpc/rxgk.c module relates to the execution of operations outside the buffer in the memory of the Linux operating system’s kernel. Exploiting this vulnerability could allow a remote attacker to gain access to protected...

Dotnetnuke < 13.3.3 Stored XSS potentially leading to host privilege escalation (GHSA-38xj-rgg3-5cjj)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 13.3.3. It is, therefore, affected by a vulnerability. - A stored cross-site scripting XSS vulnerability in the Console module could allow a Portal Administrator to execute arbitrary...

arch/arm64/kernel/sys_compat.c Heap Buffer Overflow DoS

The vulnerability of the compatarmsyscall function in the arch/arm64/kernel/syscompat.c module of the Linux operating system’s 64-bit ARM architecture kernel is related to insufficient checking of input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux drivers/scsi/hisi_sas/hisi_sas_main.c hisi_

The vulnerabilities of the functions hisisasslottaskfree, hisisasreleasetask in the module drivers/scsi/hisisas/hisisasmain.c, and deregdevicev3HW in the module drivers/scsi/hisisas/hisisasv3HW.c of the Linux kernel are related to synchronization errors when using shared resources. Exploiting the...

Linux MIPS ftrace Buffer Overflow DoS

The vulnerability of the functions ftracedynarchinitinsns and ftracemakecall in the arch/mips/kernel/ftrace.c module, which is part of the Linux operating system’s MIPS architecture support, stems from the execution of operations outside of memory buffers. Exploiting this vulnerability could allo...

ROS-20260825-73-0016

The vulnerability of the nfsd4decodecompound function in the fs/nfsd/nfs4xdr.c module, which supports the NFS network file system in Linux kernels, is related to the occurrence of operations outside of the buffer memory. Exploiting this vulnerability could allow an attacker to compromise the...

net/rxrpc/rxgk.c Kernel Session Compromise

The vulnerability of the rxgkdoverifyauthenticator function in the net/rxrpc/rxgk.c module relates to the execution of operations outside of the buffer in the memory of the Linux operating system’s kernel. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and...

Dotnetnuke < 10.3.3 Unauthorized comments on private journal posts (GHSA-86mr-4mmw-j9g2)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - An authorization vulnerability in the Journal module could allow an authenticated user to add comments to private journal posts...

Oracle Linux 9 : python-urwid (ELSA-2026-58952)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-58952 advisory. - Fix CVE-2026-9323: use cryptographically secure session identifiers in web display module Tenable has extracted the preceding description block directly from...

Linux IPv4 esp4.c esp_output_done Heap Buffer Overflow DoS

The vulnerability of the espoutputdone function in the net/ipv4/esp4.c module of the IPv4 protocol implementation in the Linux operating system is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

ALSA-2026:59496 Important: nginx:1.26 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...

Remote Code Execution (RCE)

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions,...

Remote Code Execution (RCE)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions, CustomResolver.isPathAllowed, and...