AlmaLinux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1775119189)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775119189 advisory. - In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has...

Linux Distros Unpatched Vulnerability : CVE-2026-19553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in...

SUSE SLED15 / SLES15 Security Update : cosign (SUSE-SU-2026:4392-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4392-1 advisory. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272117. -...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783353048)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783353048 advisory. - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This...

CentOS Linux 8.5 [TuxCare] Security Update: perl-CPAN Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1758822697)

The CentOS Linux 8.5 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1758822697 advisory. - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 - CPAN.pm before 2.35 does not verify TLS certificates when...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783353048)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783353048 advisory. - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This...

Linux Distros Unpatched Vulnerability : CVE-2026-96760

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS...

CVE-2026-87004: Improper Verification of Cryptographic Signature

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims...

SUSE CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

DEBIAN-CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

UBUNTU-CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-91191

The Lantronix G520 Series Cellular Gateway is vulnerable to an improper verification of cryptographic signatures in its update mechanism. During boot, the stock done function disables signature verification in the OPKG configuration before restoring packages from an unsigned feed. Furthermore, th...

CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

CVE-2026-102930

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

CVE-2026-100293

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the...

EUVD-2026-89368

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the...

CVE-2026-100293 Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the...

CVE-2026-100293 Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the...

CVE-2026-102759

NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In nxsecureverifymac, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive sequence number. The...