Rocky Linux 10.2 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_76764)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676764 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free...

Amazon Linux 2 : tigervnc (ALAS-2026-4013)

The version of tigervnc installed on the remote host is prior to 1.8.0-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4013 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues,...

Amazon Linux 2 : xorg-x11-server (ALAS-2026-4014)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4014 advisory. CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but doesnot NULL the pointer. When the error path continues, XkbClearDoodad iscalled during cleanup and frees the same pointer again,...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2026-134)

The version of kernel installed on the remote host is prior to 5.4.302-229.500. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-134 advisory. In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC...

PT-2026-125068

OrderedSkipList, SkipSet and SkipMap can free a node that is still linked when a Comparator or Ord implementation gives different answers for the same pair of values during one mutating call. A later call reads the freed memory CWE-416. A safe impl Ord with the default comparator is enough to rea...

Important: tigervnc

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Node.js 26.x HTTP/2 Use-After-Free

Node.js versions 22.x, 24.x, and 26.x contain an HTTP/2 re-entrant send flaw that can cause a heap use-after-free. Fixed releases are 22.23.2, 24.18.1, and 26.5.1...

Low: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure CVE-2026-98775 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about Amazon...

Important: firefox

Issue Overview: Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. CVE-2026-100766 Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate CVE-2026-74496 In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev CVE-2026-74743 In the Linux...

Rocky Linux 10.2 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_80674)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680674 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts componen...

Amazon Linux 2 : firefox (ALASFIREFOX-2026-067)

The version of firefox installed on the remote host is prior to 153.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-067 advisory. Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Firefo...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_80694)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680694 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts component...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-119)

The version of kernel installed on the remote host is prior to 5.15.222-158.255. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-119 advisory. In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate...

MiracleLinux 8 : xorg-x11-server-Xwayland-21.1.3-20.el8_10.4 (AXSA:2026-2137:09)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2137:09 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server:...

MiracleLinux 9 : php-8.0.30-8.el9_8.1 (AXSA:2026-2143:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2143:05 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption...

SUSE CVE-2026-98625

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

SUSE CVE-2026-98662

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU context. freeirq does not flush an irqwork the handler already queued, s...

SUSE CVE-2026-98870

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

SUSE CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...