ROOT-OS-DEBIAN-11-CVE-2024-38543 CVE-2024-38543 in linux - Patched by Root

Root has patched CVE-2024-38543 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-53254 CVE-2026-53254 in linux - Patched by Root

Root has patched CVE-2026-53254 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2025-68261 CVE-2025-68261 in linux - Patched by Root

Root has patched CVE-2025-68261 in the linux package for Root:Debian:11. Multiple fixed versions available...

Fedora 44 : tcpreplay (2026-836c3dec74)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-836c3dec74 advisory. Update to 4.6.1. Release notes: https://github.com/appneta/tcpreplay/releases/tag/v4.6.1 Tenable has extracted the preceding description block directly from...

Fedora 43 : AusweisApp2 (2026-44f6d8f2e7)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-44f6d8f2e7 advisory. Update to the latest upstream release: https://github.com/Governikus/AusweisApp/releases/tag/2.5.5 Tenable has extracted the preceding description block...

CVE-2026-76606

Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik 4.7.2...

CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-62388

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...

CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-62243

Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain non-extended X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable Java 25...

[SECURITY] Fedora 44 Update: kernel-7.1.9-200.fc44

The kernel meta package...

[SECURITY] Fedora 43 Update: kernel-7.1.9-100.fc43

The kernel meta package...

CVE-2026-77781

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

PT-2026-80621

These are all security issues fixed in the hare-0.26.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-47895

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed...

VulnCheck KEV: CVE-2026-57739

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through = 10.11.0...

Fedora 44 : rsync (2026-bfae8723e2)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bfae8723e2 advisory. New version 3.5.0. Includes fixes for following CVEs: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789...

CVE-2026-77354

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...