CVE-2026-21888 MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer()

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: getvarinteger accepts 5-byte varints without bounds checks; reliably triggers OOB read / crash when built with ASan. This affects 0.24.6 and earlier...

CVE-2025-69647

CVE-2025-69647 affects GNU Binutils readelf before or up to 2.45.1. A logic flaw in the DWARF loclists parser can cause readelf to loop indefinitely while processing a crafted binary, consuming CPU and I/O and effectively denying analysis progress. This is triggered by a malicious input file and ...

SUSE SLED15 / SLES15 Security Update : virtiofsd (SUSE-SU-2026:0819-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0819-1 advisory. This update for virtiofsd fixes the following issue: - CVE-2026-25727: time: parsing of user-provided input by the RFC...

SUSE-SU-2026:0760-1 Security update for go1.25-openssl

This update for go1.25-openssl fixes the following issues: Update to version 1.25.7. Security issues fixed: - CVE-2025-61732: cmd/go: discrepancy between Go and C/C++ comment parsing allows for C code smuggling bsc1257692. - CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated...

RHEL 8 : kernel (RHSA-2026:3360)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3360 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/core: Fix KASAN:...

CVE-2026-27621

TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting XSS vulnerability exists in the file upload module of TypiCMS prior to version 16.1.7. The application allows users with file upload permissions to upload SVG files. While there is a...

RHEL 8 : kernel (RHSA-2026:3388)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3388 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/core: Fix KASAN:...

CVE-2026-2045

GIMP vulnerability CVE-2026-2045: XWD File Parsing Out-Of-Bounds Write enables Remote Code Execution. The issue arises during parsing of XWD image files due to insufficient validation of user-supplied data, causing a write past the end of an allocated buffer and allowing code execution in the att...

CVE-2026-23152

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: correctly decode TTLM with default link map TID-To-Link Mapping TTLM elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped. Note that access point...

Linux Distros Unpatched Vulnerability : CVE-2026-23152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: correctly decode TTLM with default link map TID-To-Link Mapping TTLM elements do not contain any link mapping presence indicator if a default...

RockyLinux 8 : kernel (RLSA-2026:1662)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1662 advisory. kernel: IB/hfi1: Fix sdma.h tx-numdescs off-by-one error CVE-2024-26766 kernel: RDMA/core: Fix KASAN: slab-use-after-free Read in ibregisterdevice proble...

RockyLinux 9 : kernel (RLSA-2026:1617)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:1617 advisory. kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing CVE-2025-38568 kernel: ASoC: Intel: bytcrrt5640: Fix invalid quirk input...

CVE-2025-62603 FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabled

Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group . ParticipantGenericMessage is the DDS Security control-message container that carries not only the handshake but also on going security-control traffic after the handshake, such as...

CVE-2026-1761

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption...

Moderate: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2025-15059 GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

Azure Linux 3.0 Security Update: hyperv-daemons (CVE-2024-27436)

The version of hyperv-daemons installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27436 advisory. - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing...

MiracleLinux 8 : openssl-1.1.1k-6.el8 (AXSA:2022-3132:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3132:04 advisory. openssl: Infinite loop in BNmodsqrt reachable when parsing certificates CVE-2022-0778 Tenable has extracted the preceding description block directly from the...

MiracleLinux 7 : ruby-2.0.0.648-39.0.1.el7.AXS7 (AXSA:2024-8934:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8934:03 advisory. CVE-2021-41819: when parsing cookies, only decode the values CVEs: CVE-2021-41819 CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in...

MiracleLinux 4 : postgresql92-postgresql-9.2.14-1.AXS4 (AXSA:2015-566:02)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-566:02 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll nee...