RockyLinux 8 : .NET 9.0 (RLSA-2026:54550)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54550 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

Linux Distros Unpatched Vulnerability : CVE-2026-72057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper...

Linux Distros Unpatched Vulnerability : CVE-2026-72390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master-slaves singly linked list is not protected against multiple writes. It...

Linux Distros Unpatched Vulnerability : CVE-2026-72342

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent through mlx5hvvhcaagentcreate. The helper publishes the...

Linux Distros Unpatched Vulnerability : CVE-2026-72376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count...

PT-2026-72526

In the Linux kernel, the following vulnerability has been resolved: net/sched: act pedit: fix TOCTOU heap OOB write in tc offload There is a TOCTOU race condition in flower lockless approach between sizing a flow rule buffer and filling it. [email protected] reports: The cls flower...

Linux Distros Unpatched Vulnerability : CVE-2026-74310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The...

Linux Distros Unpatched Vulnerability : CVE-2026-72389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down...

byterag-core (0.3.0), byterag-ffi (0.3.0) +7 more potentially affected by CVE-2026-10740 via s2n-quic (1.37.0)

s2n-quic CARGO version 1.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on s2n-quic and may be impacted: - byterag-core 0.3.0 - byterag-ffi 0.3.0 - cryprot-net 0.1.0 - dbx-core =0.2.0-beta, =0.2.0-beta, =0.10.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0 Source...

EUVD-2026-58755

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...

CVE-2026-19188

CVE-2026-19188 affects the Haiwell IoT Cloud HMI Gateway. The vulnerability is an OS command injection in the Net Check feature accessed via the /setting endpoint, where the cmdPing Socket.io event does not properly sanitize user input, allowing an attacker to inject and execute arbitrary OS comm...

CVE-2026-56860

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-56853

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

RLSA-2026:54590 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

RHSA-2026:54590 Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:54574 Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:54550 Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

Bulletin has no description...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...