Security Bulletin: This Power System update is being released to address CVE-2026-11885

Summary A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise system or OS memory integrity. Vulnerability Details CVEID:CVE-2026-11885 DESCRIPTION: A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory...

CLEANSTART-2026-IE49312 Security fixes for CVE-2026-21728, CVE-2026-2303, CVE-2026-28377, CVE-2026-42151, CVE-2026-44903, CVE-2026-48096, ghsa-8396-jffm-qx4w, ghsa-cp6g-7hqx-qxhp, ghsa-ffqx-q65f-36jf, ghsa-fw8g-cg8f-9j28, ghsa-p4r4-xvrq-gvmc, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj applied in versions: 12.2.10-r1

Multiple security vulnerabilities affect the grafana package. These issues are resolved in later releases. See references for individual vulnerability details...

Oracle Linux 10 : gnutls (ELSA-2026-20613)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20613 advisory. - Fix CVE-2026-33846 - Fix CVE-2026-42009 - Fix CVE-2026-33845 - Fix CVE-2026-42010 - Fix CVE-2026-3833 - Fix CVE-2026-42011 - Fix CVE-2026-42012 - F...

Oracle Linux 10 : cups (ELSA-2026-39302)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39302 advisory. 1:2.4.10-18 - RHEL-177945 CVE-2026-34980 cups: control character injection in option values Tenable has extracted the preceding description block directly fro...

Oracle Linux 10 : nginx (ELSA-2026-36364)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36364 advisory. - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-420...

Oracle Linux 10 : podman (ELSA-2026-38495)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38495 advisory. - rebuild for CVE-2026-39822 - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681...

Oracle Linux 10 : gstreamer1-plugins-bad-free (ELSA-2026-36749)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36749 advisory. - Fix bytes/bits confusion in AV1 tile data size parsing CVE-2026-52718 Resolves: RHEL-184391 - Fix for CVE-2026-52719 Resolves: RHEL-184406 - Fix...

Oracle Linux 10 : glibc (ELSA-2026-20594)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-20594 advisory. - CVE-2026-5450: Fix buffer overflow in scanf RHEL-172694 - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules RHEL-162885 Tenable has...

AlmaLinux 10 : c-ares (ALSA-2026:42096)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:42096 advisory. c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 Tenable has extracted the preceding description block directly from the...

Oracle Linux 10 : xorg-x11-server-Xwayland (ELSA-2026-19125)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19125 advisory. - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Resolve...

Oracle Linux 10 : fence-agents (ELSA-2026-19138)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19138 advisory. - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 - bundled pyasn1: replace with dependency to fix CVE-2026-30922 Tenab...

AlmaLinux 10 : yggdrasil (ALSA-2026:39573)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:39573 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 golang.org/x/net/idna: golang: golang.org/x/net/idn...

Oracle Linux 8 : .NET / 10.0 (ELSA-2026-41900)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41900 advisory. 10.0.110-1.0.1 - Add support for Oracle Linux 10.0.110-1 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192459 Tenable has extract...

Oracle Linux 10 : .NET / 8.0 (ELSA-2026-41893)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41893 advisory. 8.0.129-1.0.1 - Add support for Oracle Linux 8.0.129-1 - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192468 8.0.128-2 - Reduce tim...

GHSA-74JP-VM22-8Q8X Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client System.Net.Mail. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exis...

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial ...

GHSA-CVVH-RHRC-WG4Q Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing System.Security.Cryptography.Xml, System.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerabilit...

GHSA-52CP-R559-CP3M js-yaml: YAML merge-key chains can force quadratic CPU consumption

Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: yaml a0: &a0 k0: 0 a1: &a1 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from...

CVE-2026-47134 ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database /Library/Application Support/clearancekit/store.db is stored in the macOS System Keychain. The key was created via the two-step patte...

CVE-2026-47133

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store /Library/Application Support/clearancekit/store.db is verified using an ECDSA signature stored in the datasignatures table. T...