PT-2026-105072

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

PT-2026-105575

OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao...

PT-2026-105125

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num...

Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_36790)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636790 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8854-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8854-1 advisory. Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions...

Rocky Linux 9 [CIQ] Security Update: libxslt / libxslt-debuginfo / libxslt-debugsource / libxslt-devel (crlsa-2026_6266)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266266 advisory. libxslt: Processing web content may disclose sensitive information CVE-2023-40403 Tenable has extracted the preceding description block directly from the CIQ securi...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2026_10949)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202610949 advisory. python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules CVE-2026-6100 python: cpython: Python:...

Debian dsa-6535 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6535 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6535-1 [email protected] https://www.debian.org/securit...

Rocky Linux 10.1 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_2721)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262721 advisory. kernel: ntbhwswitchtec: Fix shift-out-of-bounds in switchtecntbmwsettrans CVE-2023-53034 kernel: Linux kernel erofs: Use-After-Free due to device type...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel Multiple Vulnerabilities (crlsa-2020_4743)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204743 advisory. squid: Improper input validation in request allows for proxy manipulation CVE-2019-12520 squid: Off-by-one error in addStackElement allows for heap buffer...

AlmaLinux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1788195197)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788195197 advisory. - A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but do...

Linux Distros Unpatched Vulnerability : CVE-2026-47512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2025_15687)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202515687 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decod...

Rocky Linux 10.2 [CIQ] Security Update: ruby4.0 / ruby4.0-debuginfo / ruby4.0-debugsource / ruby4.0-devel / etc Multiple Vulnerabilities (crlsa-2026_20606)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620606 advisory. ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection CVE-2026-33210 erb: ERB: Arbitrary code execution via...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2026_0694)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260694 advisory. firefox: Spoofing issue in the Downloads Panel component CVE-2025-14327 firefox: Use-after-free in the JavaScript: GC component CVE-2026-0885 firefox:...

PT-2026-105590

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...

PT-2026-103899

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...

PT-2026-103938

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

CVE-2026-96255: Exposure of Sensitive Information to an Unauthorized Actor

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...

PT-2026-103980

Name of the Vulnerable Software and Affected Versions Cadmos LTI versions prior to 2026-09-02 Description The application had Laravel debug mode enabled in a publicly accessible environment. An unauthenticated attacker could send a GET request to trigger an unhandled exception, leading to the...