Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘wireguard: device: enable threaded NAPI’” This resolution involves commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c, which is a commit from upstream. We received three independent reports from production users who were...

CVE-2026-12570

A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...

CVE-2026-71870

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/cmap.py function parsebfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed...

EUVD-2026-54615

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/cmap.py function parsebfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed...

CVE-2026-71852

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extractio...

CVE-2026-66058

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

CVE-2026-66058

CVE-2026-66058 affects the Frappe framework. Prior to versions 16.20.0 and 15.112.0 , an authenticated user could gain unrestricted access to the Document Follow API (update_follow). The issue is fixed in those versions. The available sources confirm the vulnerable behavior as an unauthorized/unr...

[slackware-security] p11-kit

New p11-kit packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/p11-kit-0.26.5-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: rpc: guard against overflow when decoding nested...

[slackware-security] libXfont2

New libXfont2 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libXfont2-2.0.9-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Font Server Client encoding Out-Of-Bounds...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3513-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3513-1 advisory. - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. ...

Linux Distros Unpatched Vulnerability : CVE-2026-71852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py...

SUSE SLED15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2026:3507-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3507-1 advisory. - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. -...

SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:3503-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3503-1 advisory. - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. - CVE-2026-15337: potential denial-of-service...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3510-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3510-1 advisory. - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. -...

macOS 15.x < 15.7.9 (148171)

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.7.9. It is, therefore, affected by a vulnerability: - An attacker on the network may be able to authenticate to Screen Sharing without valid credentials CVE-2026-65400 Note that Nessus has not tested for this issue...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3509-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3509-1 advisory. Update to version 8.3.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded...

SUSE SLES15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2026:3505-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3505-1 advisory. - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot...

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-17506

CVE-2026-17506 affects the Independent Analytics plugin for WordPress up to version 2.15.0. The vulnerability is a Stored XSS in the 404 not_found_url tracking parameter caused by get_cell_content() applying urldecode() after esc_url() when rendering the URL column for 404 entries, allowing perce...

EUVD-2026-53045

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit i...