Debian dla-4781 : firefox-esr - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4781 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4781-1 [email protected]...

Linux Distros Unpatched Vulnerability : CVE-2026-59739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registerin...

Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ALSA-2026:68676 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

RockyLinux 8 : .NET 8.0 (RLSA-2026:68316)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:68316 advisory. dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability CVE-2026-58649 Bug Fixes and Enhancements: Update .NET 8.0 to SDK 8.0.131 and Runtime...

The vulnerability of the upload_attachment function in the MPC-server for Atlassian’s Model Context Protocol (MCP) products allows a perpetrator to disclose protected information.

The vulnerability of the uploadattachment function in MPC-servers for Atlassian Model Context Protocol MCP products is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

RockyLinux 8 : .NET 9.0 (RLSA-2026:68233)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68233 advisory. dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability CVE-2026-58649 dotnet10.0: dotnet9.0: .NET Elevation of Privilege...

UBUNTU-CVE-2026-59739

Information disclosure via SetWatches reconnect replay in Apache ZooKe...

CVE-2026-65388

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...

CVE-2026-61589

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to...

CVE-2026-61588

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as...

CVE-2026-84640

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed mail header. This could lead to a one-byte read past the end of a buffer, potentially resulting in information disclosure or other unpredictable behavior...

CVE-2026-9335-keras-hdf5-externallink

CVE-2026-9335 — Keras HDF5 ExternalLink local file-content disclosure Two public Keras APIs — keras.saving.KerasFileEditor and keras.saving.loadweights / — read HDF5 group members by without a link-type check. h5py / on indexing, so an attacker-supplied , , or file containing only a link causes...

CVE-2026-92239

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed Internet Message Access Protocol IMAP line. This could lead to an out-of-bounds buffer read, potentially resulting in information disclosure or a denial of service...

CVE-2026-65388

CVE-2026-65388 affects Apple's containerization (apple/container). A remote attacker who controls a container registry can redirect a client's token request to a host of the attacker's choosing, disclosing the victim's registry credentials. The root cause is related to insufficient enforcement of...

CVE-2026-65388

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...

CVE-2026-92591

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92577

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

CVE-2026-89034

TCH QRing smart ring model R20B006 running firmware RT09R201.00.00250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service...

CVE-2026-20284

creationtimestamp| type| source ---|---|--- 2026-09-16 22:10:38+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvo5ryaqbm2t 2026-09-16 23:30:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvoca4x5ii24 2026-09-18 10:00:06+00:00| exploited|...