Photon OS 5.0: Frr PHSA-2025-5.0-91-0462

An update of the frr package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0462. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Expat PHSA-2024-5.0-91-0229

An update of the expat package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0229. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Memcached PHSA-2023-5.0-91-0140

An update of the memcached package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0140. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2026-5.0-91-0854

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0854. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Imagemagick PHSA-2025-5.0-91-0664

An update of the ImageMagick package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0664. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-67198

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with ...

CLSA-2026-1785204448 TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 5 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.1...

CLSA-2026-1774916711 TuxCare security update for serialize-javascript (1 CVE)

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

CLSA-2026-1773015264 TuxCare security update for semver (1 CVE)

TuxCare rebuilt semver to address 1 CVE. Fixed in 5.0.3-tuxcare.1...

CLSA-2025-1757635895 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.post4+tuxcare...

CLSA-2025-1756858298 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.1.post2+tuxcare...

CLSA-2025-1765411677 TuxCare security update for 38 packages (1 CVE)

TuxCare rebuilt 38 packages to address 1 CVE. Fixed in 9.0.50-tuxcare.3...

CLSA-2025-1756080325 TuxCare security update for com.google.protobuf:protobuf-java (2 CVEs)

TuxCare rebuilt com.google.protobuf:protobuf-java to address 2 CVEs. Fixed in 2.5.0-tuxcare.1...

CLSA-2024-1733443231 TuxCare security update for com.fasterxml.woodstox:woodstox-core (1 CVE)

TuxCare rebuilt com.fasterxml.woodstox:woodstox-core to address 1 CVE. Fixed in 5.0.3.tuxcare...

CVE-2026-67200 Perspective 5.0.0 Path Traversal via cwd_static_file_handler

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

PT-2026-67414

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...

CVE-2026-18437

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...

WordPress Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin <= 5.0.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by NOn Nss in WordPress Plugin Taskbuilder versions = 5.0.9...

SUSE CVE-2026-42882

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the...