RHEL 8 : cups-filters (RHSA-2026:57451)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57451 advisory. The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS distributio...

PT-2026-80733

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 0.11.0 through 1.44.0 Description The OpenTracing bridge contains an unsynchronized extraBaggageItems map within the bridgeSpan component. Because Go maps do not support safe concurrent read and write access,...

CVE-2026-63383: Out-of-bounds Read

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer...

CVE-2026-63381: Use of Uninitialized Resource

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf-first,...

Elasticsearch 8.19.x < 8.19.20 / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-80 / ESA-2026-123)

The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-80 and ESA-2026-123 advisories. - The native inference process that...

CVE-2026-70654: Heap-based Buffer Overflow

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can access sensitive information by triggering specific log events under certain conditions. Remediation Upgrade...

kbd security update

2.4.0-12 - Fix CVE-2026-72693: openvt -u process matching made more conservative Resolves: RHEL-235988...

RockyLinux 10 : libcupsfilters (RLSA-2026:56965)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56965 advisory. libcupsfilters: cups-filters: libcupsfilters: CPU exhaustion via infinite loop in cfIEEE1284NormalizeMakeModel CVE-2026-64611 libcupsfilters:...

ALSA-2026:57451 Moderate: cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS distribution but is now maintained independently. Security Fixes: libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PN...

CVE-2026-63381: Use of Uninitialized Resource

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf-first,...

PT-2026-79127

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.173 Description Incorrect authorization in Workers allows a remote attacker who has compromised the renderer process and used social engineering to bypass the web origin policy through a crafted HTML...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the process that handles incoming payloads. An attacker can cause service disruption by sending specially crafted malicious payloads. Remediation Upgrade...

Moderate: kbd security update

The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files. Security Fixes: kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login CVE-2026-726...

Moderate: cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS distribution but is now maintained independently. Security Fixes: libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PN...

CVE-2026-63387: Stack-based Buffer Overflow

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check...

Linux Distros Unpatched Vulnerability : CVE-2026-64787

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadO...

RHEL 8 : webkit2gtk3 (RHSA-2026:57348)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57348 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

CVE-2026-75569

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...