PT-2026-69797

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory management issue exists in the net/iucv component. The function afiucv hs rcv identifies a destination socket while holding the iucv sk list.lock, but releases the lock and pass...

Linux Distros Unpatched Vulnerability : CVE-2026-68377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst o...

RHEL 9 : ignition (RHSA-2026:52826)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52826 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regula...

The vulnerability of the ceph_handle_auth_reply() function in the net/ceph/auth.c module of the Linux operating system allows a hacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the cephhandleauthreply function in the net/ceph/auth.c module of the Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and accessibility of...

RHEL 8 : osbuild-composer (RHSA-2026:52389)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52389 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...

Linux Distros Unpatched Vulnerability : CVE-2026-68140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.2 (AXSA:2026-1500:11)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1500:11 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...

The vulnerability in the `net/packet/af_packet.c` component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the net/packet/afpacket.c component of the Linux operating system is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the .NET software platform, related to the unlimited distribution of resources, allows a hacker to cause a service failure.

The vulnerability of the .NET software platform is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

RHEL 8 : osbuild-composer (RHSA-2026:52391)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52391 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...

Linux Distros Unpatched Vulnerability : CVE-2026-68141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The...

Linux Distros Unpatched Vulnerability : CVE-2026-68138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a pla...

The vulnerability of the net/http.Transport component, which is used by the Containous Traefik reverse proxy server, allows attackers to disclose sensitive information that should be protected.

The vulnerability of the net/http.Transport component, which is used by the Containous Traefik reverse proxy server, is related to HTTP request processing flaws. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the system...

CVE-2026-19348

The CVE-2026-19348 entry concerns Shenzhen Aitemi M300 Wi‑Fi Repeater. A vulnerability in the sprintf handling within /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1 allows remote command injection by manipulating parameters such as enable/name/mac. Impact is h...

EUVD-2026-54917

A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilterconf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command...

Unbreakable Enterprise kernel security update

6.12.0-205.92.4.2 - net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp Dongli Zhang Orabug: 39844842 - x86/bugs: Make Safe-RET robust against interrupt injection Borislav Petkov AMD Orabug: 39844812 CVE-2026-68480 - KVM: x86: Check for invalid/obsolete root after making MMU...

CVE-2026-11742

The kernel queue helper zqueuenodepeek in kernel/queue.c dereferences a node taken from a queue's dataq list, reading the node's flag byte and, for items enqueued via kqueueallocappend/allocprepend, the data pointer of an internally allocated allocnode struct. The implementations of...

SUSE-SU-2026:23170-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

MiracleLinux 9 : grafana-10.2.6-23.el9_8 (AXSA:2026-1487:22)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1487:22 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...