Photon OS 5.0: Linux PHSA-2024-5.0-91-0374

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0374. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...

Malicious code in @servicetitan/microfront-tests (npm)

npm/@servicetitan/microfront-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/acquisition-functions (npm)

npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

MAL-2026-11841 Malicious code in @servicetitan/contentful (npm)

npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1784596277 TuxCare security update for qs (5 CVEs)

TuxCare rebuilt qs to address 5 CVEs. Fixed in 2.2.4-tuxcare.1...

CLSA-2026-1783558967 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 9.52.21-p2+tuxcare...

CLSA-2026-1780620677 TuxCare security update for csvtojson (2 CVEs)

TuxCare rebuilt csvtojson to address 2 CVEs. Fixed in 2.0.8-tuxcare.1...

CLSA-2026-1776731780 TuxCare security update for sockjs (4 CVEs)

TuxCare rebuilt sockjs to address 4 CVEs. Fixed in 0.3.19-tuxcare.1...

CLSA-2026-1776299672 TuxCare security update for postcss (3 CVEs)

TuxCare rebuilt postcss to address 3 CVEs. Fixed in 7.0.14-tuxcare.1...

CLSA-2026-1774484503 TuxCare security update for minimatch (18 CVEs)

TuxCare rebuilt minimatch to address 18 CVEs. Fixed in 0.3.0-tuxcare.1...

CLSA-2026-1774743812 TuxCare security update for hawk (19 CVEs)

TuxCare rebuilt hawk to address 19 CVEs. Fixed in 1.0.0-tuxcare.1...

CLSA-2026-1773015258 TuxCare security update for hawk (5 CVEs)

TuxCare rebuilt hawk to address 5 CVEs. Fixed in 3.1.0-tuxcare.1...

CLSA-2026-1773101683 TuxCare security update for form-data (3 CVEs)

TuxCare rebuilt form-data to address 3 CVEs. Fixed in 0.2.0-tuxcare.1...

CVE-2026-67195

CVE-2026-67195 describes a remote code execution in Perspective 5.0.0 via an eval() expression injection in the PolarsVirtualServer backend. The vulnerability occurs when client-supplied input is passed directly to Python’s eval() with almost no sandboxing (builtins cleared). Attackers can traver...

CVE-2026-10710

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2026-10710

Summary: CVE-2026-10710 involves a stack-based buffer overflow in Autodesk FBX SDK, specifically in the fbxsdk::ExtractDrive path when parsing a malicious FBX file. The NVD/CVE records describe that exploitation can allow arbitrary code execution in the context of the current process, with a CVSS...

CVE-2026-10710 FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::ExtractDrive. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

EUVD-2026-52669

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...

CVE-2026-10709

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process...