CVE-2026-72448

A flaw was found in the octeontx2-pf driver in the Linux kernel. When a network interface utilizing this driver is shut down or the device is removed, a memory leak occurs because the send-queue timestamp buffer is not properly deallocated. This continuous memory accumulation can lead to system...

CVE-2026-72390

A flaw was found in the Linux kernel's schteql module. The teql master-slaves linked list, which manages network traffic queues, is not adequately protected against simultaneous modifications. This lack of protection can lead to a race condition, allowing a local attacker to trigger a...

CVE-2026-72405

A flaw was found in the Linux kernel's UDP tunnel networking component. A race condition in the udptunnelnicdevicesync function allows a work item to be double-queued. This can lead to a use-after-free vulnerability, where memory is prematurely freed while still active. A local attacker could...

CVE-2026-74353

A flaw was found in the drm/amdkfd component of the Linux kernel. This vulnerability occurs when the system fails to properly resume all queues after a suspend operation, even if some suspend operations fail. An attacker could potentially exploit this by triggering a scenario where queue removal...

CVE-2026-76387: Improper Input Validation

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mcinvestigationread capability could inject Search Processing Language SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity...

PT-2026-78814

Name of the Vulnerable Software and Affected Versions Splunk Enterprise Security versions prior to 8.6.1 Description A user with a role containing the mc investigation read capability can perform Search Processing Language SPL injection via Analyst Queue search filters. This occurs because the...

MiracleLinux 8 : nghttp2-1.33.0-6.el8_10.3 (AXSA:2026-1576:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1576:03 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted t...

SUSE CVE-2026-68228

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Move srcbuf Removal to finishencode During encoder processing, there is a case where the IRQ response could return the buffer back to userspace via v4l2m2mbufdone call. In this time, userspace could que...

CVE-2026-52732

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAXINBOUNDCONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally withou...

EUVD-2026-61170

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAXINBOUNDCONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally withou...

CVE-2026-52732 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAXINBOUNDCONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the bounded queue was shared globally withou...

CVE-2026-52732

ZEBRA (zebrad), a Zcash node written in Rust, is vulnerable to mempool transaction admission denial via single-peer inbound queue saturation in versions prior to 4.5.0 . A single unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in the inbound mempool download/verificat...

SUSE CVE-2026-68129

In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...

SUSE CVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

CVE-2026-72375

A flaw was found in the Linux kernel's AFS Andrew File System component. This vulnerability arises from improper reinitialization of internal work queue objects, specifically afsvnode::lockwork. An attacker could potentially exploit this flaw to trigger kernel warnings and lead to system...

RLSA-2026:55804 Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...

nghttp2 security update

1.33.0-6.3 - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055...

Linux Distros Unpatched Vulnerability : CVE-2026-74284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e....

RockyLinux 8 : nghttp2 (RLSA-2026:55804)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55804 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the...

RHEL 8 : nghttp2 (RHSA-2026:55804)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:55804 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP...