CVE-2026-23991: Reachable Assertion

go-tuf is a Go implementation of The Update Framework TUF. Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository or any of its mirrors returns invalid TUF metadata JSON valid JSON but not well formed TUF metadata, the client will panic during parsing, causing a denial of...

Azure Linux 3.0 Security Update: hyperv-daemons (CVE-2024-27033)

The version of hyperv-daemons installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27033 advisory. - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to remove unnecessary...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46843)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46843 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only i...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37773)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37773 advisory. - In the Linux kernel, the following vulnerability has been resolved: virtiofs: add filesystem context source...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38218)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38218 advisory. - In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on...

Azure Linux 3.0 Security Update: kernel (CVE-2024-45001)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45001 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix RX buf allocsize alignmen...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38166)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38166 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38165)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38165 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix panic when calling...

CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2025-47913)

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47913 advisory. - SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause ear...

CVE-2026-23831: NULL Pointer Dereference

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate returns nil success when message is...

Azure Linux 3.0 Security Update: kernel (CVE-2024-50023)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50023 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: phy: Remove LED entry from LEDs lis...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38290)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38290 advisory. - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in...

Azure Linux 3.0 Security Update: cni / containernetworking-plugins / keda / multus (CVE-2021-38561)

The version of cni / containernetworking-plugins / keda / multus installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-38561 advisory. - golang.org/x/text/language in golang.org/x/text before 0.3.7 can...

Azure Linux 3.0 Security Update: kernel (CVE-2025-22033)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22033 advisory. - In the Linux kernel, the following vulnerability has been resolved: arm64: Don't call NULL in...

Azure Linux 3.0 Security Update: multus (CVE-2020-28851)

The version of multus installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-28851 advisory. - In x/text in Go 1.15.4, an index out of range panic occurs in language.ParseAcceptLanguage while parsing the...

Azure Linux 3.0 Security Update: python-tensorboard (CVE-2019-17596)

The version of python-tensorboard installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-17596 advisory. - Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38369)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38369 advisory. - In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Check availability of...

PT-2026-4280

Name of the Vulnerable Software and Affected Versions Rekor versions 1.4.3 and below Description Rekor’s entry implementation can experience a panic when processing attacker-controlled input during the canonicalization of a proposed entry with an empty spec.message. The validate function...

Azure Linux 3.0 Security Update: python-tensorboard (CVE-2021-33196)

The version of python-tensorboard installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-33196 advisory. - In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count in an archive...

GHSA-846P-JG2W-W324 go-tuf affected by client DoS via malformed server response

Security Disclosure: Client DoS via malformed server response Summary If the TUF repository or any of its mirrors returns invalid TUF metadata JSON valid JSON but not well formed TUF metadata, the client will panic during parsing, causing a DoS. The panic happens before any signature is validated...