CVE-2026-59694 Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a large multiplier, degrading the sponsor's operating margin. When the mpp Elixir library is configured as fee payer feepayer: true,...

CVE-2026-59694 Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a large multiplier, degrading the sponsor's operating margin. When the mpp Elixir library is configured as fee payer feepayer: true,...

CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer feepayer: true,...

EEF-CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer fee\payer: true,...

CVE-2026-59695

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer feepayer: true,...

CVE-2026-59695

Vulnerability summary (CVE-2026-59695). The ZenHive mpp Elixir library, when configured as a fee payer (fee_payer: true), is vulnerable to an unauthenticated remote client that can drain the fee-payer wallet in a single request. The root cause is improper validation in MPP.Tempo.Transaction.cosig...

CVE-2026-59695 Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by naming an arbitrarily high gas price. When the mpp Elixir library is configured as fee payer feepayer: true,...

CVE-2026-21770

CVE-2026-21770 affects HCL Traveler for Microsoft Outlook (HTMO). The vulnerability is described as a DLL hijacking issue that could allow an attacker to modify or replace HTMO with malicious content. Per the provided metrics, exploitability is Local with LOW complexity, but HIGH privileges are r...

[SECURITY] Fedora 44 Update: freerdp-3.29.0-1.fc44

The xfreerdp & wlfreerdp Remote Desktop Protocol RDP clients from the FreeR DP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox...

go-fdo-client security update

1.0.0-4 - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 1.0.0-3 - Rebuild to fix CVE-2026-32283...

PT-2026-60872

Name of the Vulnerable Software and Affected Versions IBM Storage Protect Client versions 8.1.0.0 through 8.1.27.1 IBM Storage Protect Client versions 8.2.0.0 through 8.2.1.0 Description Improper bounds checking leads to a heap-based buffer overflow, which occurs when a program writes more data t...

RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.20 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 Multiple Vulnerabilities

The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the...

The vulnerability of the urb_write_completion() function in the RDP client FreeRDP allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the urbwritecompletion function in the RDP client FreeRDP relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause service failures or execute arbitrary code...

Oracle Linux 10 : dnsmasq (ELSA-2026-19158)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19158 advisory. - Prevent overflow in extractname function CVE-2026-2291 - Prevent DoS in DNSSEC validation CVE-2026-4890 - Prevent out-of-bounds read in DNSSEC...

SUSE SLES12 Security Update : kernel (Live Patch 74 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3065-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3065-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 fixes various security issues The following security issues were fixed: -...

PT-2026-60770

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

PT-2026-60741

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

Oracle Linux 10 : go-fdo-client / and / go-fdo-server (ELSA-2026-22141)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22141 advisory. - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 - Rebuild to fix CVE-2026-32283 go-fdo-server - Rebuild to fix CVE-2026-32282 and CVE-2025-68121...

Oracle Linux 10 : go-fdo-client (ELSA-2026-19139)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-19139 advisory. - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

PT-2026-60798

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned...