6781 matches found
Astra Linux – Vulnerability in exiv2
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A assertion failure occurs when Exiv2 is used to modify the metadata of a specially crafted image file. An attacker could potentially exploit this vulnerability to cause a...
Astra Linux – Vulnerability in Cpio
Debian’s cpio package contains a path traversal vulnerability. This issue was introduced by reverting the CVE-2015-1197 patches, which caused a regression in the --no-absolute-filenames option. Upstream has since provided a proper fix for this issue...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: i40e: Fixed the issue where “vf” might be used without initialization in this function. To address the regression introduced by commit 52424f974bc5, which causes servers to hang under very difficult-to-reproduce conditions due...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
There is a vulnerability in the Linux Kernel within the KVM framework: nVMX, which allows for speculative execution attacks. L2 can execute Spectre v2 attacks on L1, as L1 believes it does not need retpolines or IBPB after executing L2, due to KVM L0 advertising eIBRS support to L1. An attacker a...
CVE-2023-32803
A flaw was found in the ca-certificates package. This issue prevents the proper removal of certain TrustCor root certificates from the root store. A remote attacker could potentially exploit this vulnerability to leverage these unremoved certificates, leading to a compromise of data integrity. Th...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2024-004029)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-004029 advisory. A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. AddType and similar configuration,...
EUVD-2026-76736
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed,...
CVE-2026-90455
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed,...
Fedora 45 : tar (2026-ee1eb89e7b)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee1eb89e7b advisory. Fix CVE-2026-5704, CVE-2026-18508, CVE-2026-18477, and a regression in the fix for CVE-2025-45582. Tenable has extracted the preceding description...
USN-8571-2: Apache HTTP Server regression
USN-8571-1 fixed vulnerabilities in Apache HTTP Server. That fix was incomplete due to a missing library symbol, resulting in a regression that could cause Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. This update fixes the problem. We apologize for the inconvenience...
polkit: Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
No description is available for this CVE...
Fedora 44 : tar (2026-044e56d9ff)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-044e56d9ff advisory. Fix build with libacl 2.4.0, fix CVE-2026-5704, CVE-2026-18508, CVE-2026-18477, and a regression in the fix for CVE-2025-45582. Tenable has extracte...
UBUNTU-CVE-2026-85498
Regression in CVE-2026-4897 fix polkit readcookie - stack buffer underflow...
CVE-2026-85498
Regression in CVE-2026-4897 fix polkit readcookie - stack buffer underflow...
Linux Distros Unpatched Vulnerability : CVE-2026-80894
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommufd: Fix wrong hwpt passed to iommufdautoresponsefaults on replace iommufdhwptreplacedevice calls: iommufdautoresponsefaultshwpt, oldhandle %NASLMINLEVEL...
CVE-2026-85152
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...
CVE-2026-80894 iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufdautoresponsefaults on replace iommufdhwptreplacedevice calls: iommufdautoresponsefaultshwpt, oldhandle; passing the new hwpt together with the handle of the device's old domain. This shoul...
CVE-2026-80894
CVE-2026-80894 affects the Linux kernel iommufd subsystem . The bug is a parameter mismatch in iommufd_hwpt_replace_device(), which passes the new hardware page table (hwpt) to iommufd_auto_response_faults() instead of the old one. Because fault groups are queued under the hwpt active at fault-de...
CVE-2026-80894 iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufdautoresponsefaults on replace iommufdhwptreplacedevice calls: iommufdautoresponsefaultshwpt, oldhandle; passing the new hwpt together with the handle of the device's old domain. This shoul...
