SUSE-SU-2026:22727-1 Security update for the Linux Kernel RT (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues The following security issues were fixed: - CVE-2026-43501: ipv6: rpl: reserve maclen headroom when recompressed SRH grows bsc1266015. - CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/dow...

SUSE-SU-2026:22710-1 Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues The following security issues were fixed: - CVE-2026-43501: ipv6: rpl: reserve maclen headroom when recompressed SRH grows bsc1266015. - CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/dow...

CVE-2026-53366 ipv4: account for fraggap on the paged allocation path

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In ipappenddata, when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;...

CVE-2026-15013

Technical details are not publicly available in the provided documents. Monitor for updates.

[SECURITY] Fedora 43 Update: xrdp-0.10.6.1-1.fc43

xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client...

[SECURITY] Fedora 44 Update: roundcubemail-1.7.2-1.fc44

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions

Overview A denial-of-service DoS vulnerability exists in some HTTP/2 server implementations that fail to adequately limit resource consumption when buffering response data under stalled flow-control conditions. A remote, unauthenticated attacker can trigger memory exhaustion and service...

SUSE SLES12 Security Update : kernel (Live Patch 80 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:2994-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2994-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.302 fixes various security issues The following security issues were fixed: -...

PT-2026-60605

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2026-1904)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1904 advisory. ICMPv6 PvD protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-5299 AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 an...

CVE-2024-32386

CVE-2024-32386 affects Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042, with a directory traversal vulnerability that allows an adjacent attacker to obtain sensitive information through the SNMP update mechanism. The CVSSv3.1 base score is 7.3 (HIGH) with attack vector ADJACENT, low atta...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1929)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1929 advisory. tarfile.extractall with the 'data' or 'tar'filter could be bypassed by a crafted archive where a hardlinkreferences a symlink stored at a deeper name than the hardlink itself.The extraction...

The vulnerability of the decompression mechanism used by frameworks for developing network applications, servers, and client protocols via Netty allows a hacker to induce a service failure.

The vulnerability of the decompression mechanism used by frameworks for developing network applications, servers, and protocol clients related to Netty involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-8547-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8547-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

SUSE SLES15 Security Update : kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:3002-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3002-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.115 fixes various security issues The following security issues were fixed: -...

PT-2026-60411

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 7.1.4-1.1 Description An issue exists in the IPv4 implementation within the ip append data function. When the paged-allocation branch is executed, the alloclen and pagedlen variables are calculated incorrectly...

Improper Handling of Length Parameter Inconsistency

Overview websocket-driver is a websocket protocol handler with pluggable I/O. Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency through the hybi.js WebSocket frame processing in lib/websocket/driver. An attacker can corrupt how the server pars...

websocket-driver: Message corruption via abuse of protocol length headers

Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server pars...

NPM: websocket-driver: Message corruption via abuse of protocol length headers

NPM: websocket-driver: Message corruption via abuse of protocol length headers vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

GHSA-GHHP-3QVG-889P websocket-driver: Memory exhaustion via abuse of protocol length headers

Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a server or client can make the...