CVE-2026-54143: tinyhumansai openhuman: OpenHuman is an open-source agent harness available as a desktop application and Rust library

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. The scheduler later executes...

CVE-2026-18159: OpenText OpenText Directory Services (OTDS): A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking

A vulnerability in OpenText OpenText Directory Services OTDS on Windows and Linux allows Clickjacking. This issue affects OpenText Directory Services OTDS: from 10.5 through 26.2...

CVE-2026-116572: signalwire freeswitch: FreeSWITCH is an open-source software telecommunications platform

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in modsofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and...

CVE-2026-69144: SuiteCRM: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...

CVE-2026-97377: SuiteCRM: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-63213: SuiteCRM: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden ziptodir parameter, while cleanpath does not reject traversal sequences. An authenticated administrator can copy...

CVE-2026-54912: bytecodealliance wasm-micro-runtime: WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime

WebAssembly Micro Runtime WAMR is a lightweight standalone WebAssembly Wasm runtime. Prior to 2.4.5, the two-pass fast interpreter loader in core/iwasm/interpreter/wasmloader.c can make inconsistent constant-table decisions between the sizing pass and the emitting pass. After duplicate constants...

CVE-2026-76580: OpenText OpenText Directory Services (OTDS): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText…

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in OpenText OpenText Directory Services OTDS on Windows and Linux allows Cross-Site Scripting XSS. This issue affects OpenText Directory Services OTDS: from 25.1 through 26.2...

CVE-2026-48705: Project-MONAI MONAI: MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader.getaffine trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An...

CVE-2026-123158: OpenBSD OpenSSH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

CVE-2026-77622: BishopFox sliver: Sliver is a command and control framework

Sliver is a command and control framework. Prior to 1.7.6, an HTTPS listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is...

CVE-2026-77439: immich-app immich: Immich is a self-hosted photo and video management solution

Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and then promoting...

CVE-2026-75599: sysadminsmedia homebox: HomeBox is a home inventory and organization system

HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. Wh...

CVE-2026-112208: Red Hat: A flaw was found in the Organization identity-first login flow of the Keycloak authentication server

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiat...

SUSE SLES15 Security Update : kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:5059-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5059-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.73 fixes various security issues: The following security issues were fixed: -...

TencentOS Server 4: java-11-konajdk (TSSA-2026:1330)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1330 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

SUSE SLES15 Security Update : kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:5055-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5055-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130 fixes various security issues: The following security issues were fixed: -...

MiracleLinux 9 : dpdk-25.11-2.el9_8 (AXSA:2026-2256:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2256:03 advisory. dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor double-fetch...

Linux Distros Unpatched Vulnerability : CVE-2026-118514

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - symfony - None Ubuntu Linux - Unknown description CVE-2026-118514 Note that Nessus relies on the presence of the package as reported by the vendo...

SUSE SLES15: libipa_hbac-devel / libipa_hbac0 / libsss_certmap-devel / etc (SUSE-SU-2026:5079-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5079-1 advisory. - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a...