EulerOS 2.0 SP15 : docker-engine (EulerOS-SA-2026-3972)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privileg...

openSUSE 16 Security Update : golang-github-prometheus-alertmanager (openSUSE-SU-2026:22027-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22027-1 advisory. Changes in golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net ...

Security Bulletin:UltraJSON Malformed UTF-8 Byte Sequence Vulnerability

Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into...

CVE-2026-106442

A flaw was found in hydra-core. The instantiate mechanism does not properly validate callable targets against its blocklist, allowing execution wrappers and deferred calls to bypass authorization checks. An attacker who convinces an application or user to process untrusted configuration files can...

tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation

A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of reques...

Exploit for Improper Certificate Validation in Checkpoint Gaia_Embedded

CVE-2026-85102 — Check Point Unauthenticated VPN Tunnel Establ...

MiracleLinux 9 : nodejs:24 (AXSA:2026-1984:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1984:01 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificat...

Security update for prometheus-blackbox_exporter (important)

openSUSE security update: security update for prometheus-blackboxexporter ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22026-1 Rating: important References: bsc1236515 bsc1238680 bsc1266556 bsc1279126 Cross-References: CVE-2023-45288 CVE-2025-228...

Security update for golang-github-prometheus-alertmanager (important)

openSUSE security update: security update for golang-github-prometheus-alertmanager ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22027-1 Rating: important References: bsc1266615 bsc1269834 Cross-References: CVE-2026-2303 CVE-2026-39821 CVSS score...

CVE-2026-106446

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-106446

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-105867

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

OPENSUSE-SU-2026:22027-1 Security update for golang-github-prometheus-alertmanager

This update for golang-github-prometheus-alertmanager fixes the following issues: Changes in golang-github-prometheus-alertmanager: - CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.57.0 bsc1266615 - Update to version 0.33.1 jscPED-16708:...

AZL-106332 CVE-2026-98317 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

DEBIAN-CVE-2026-98317

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

CVE-2026-98317

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

UBUNTU-CVE-2026-98317

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

CVE-2026-98317 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...