RockyLinux 8 : python3.12 (RLSA-2026:39893)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39893 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

AlmaLinux 9 : python3.12 (ALSA-2026:39771)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39771 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

PT-2026-60499

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

openSUSE 16 Security Update : python-soupsieve (openSUSE-SU-2026:21342-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21342-1 advisory. This update for python-soupsieve fixes the following issues - CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists...

Linux Distros Unpatched Vulnerability : CVE-2026-48125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user- agent data. From 2.0.1 until 2.0.10, a regular expressio...

SUSE SLED15 / SLES15 Security Update : sccache (SUSE-SU-2026:3022-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3022-1 advisory. Update to version 0.15.017. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when ...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-1926)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1926 advisory. Heap buffer overflow in the Matroska MKV demuxer when calculating decompressed buffer sizes for bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculatio...

RHEL 9 : python3.9 (RHSA-2026:39798)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39798 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 8 : python3.12 (RHSA-2026:39893)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39893 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RockyLinux 9 : python3.12 (RLSA-2026:39771)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39771 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

ALSA-2026:40856 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-60500

Name of the Vulnerable Software and Affected Versions XML::Bare versions prior to 0.53 Description The software may enter an infinite loop when parsing malformed attributes. This occurs because the c parse function fails to advance the attribute-parse state cursor when encountering specific...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-1917)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1917 advisory. A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gstav1parserparsetilelistobu function passes a byte count to a bit-reader API that expects a...

RHEL 10 : python3.14 (RHSA-2026:40856)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40856 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

AlmaLinux 8 : python3.12 (ALSA-2026:39893)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39893 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1930)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1930 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking

A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XMLResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service...

websocket-driver: Memory exhaustion in HTTP header parser

Impact If this library is used to implement a WebSocket server on top of a TCP server rather than an HTTP server or framework using the WebSocket::Driver.server method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memo...

GHSA-8J3G-F24P-4MPW websocket-driver: Memory exhaustion in HTTP header parser

Impact If this library is used to implement a WebSocket server on top of a TCP server rather than an HTTP server or framework using the WebSocket::Driver.server method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memo...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...