AlmaLinux 9.2 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1779190223)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779190223 advisory. - A vulnerability was found in OpenSC where PKCS1 encryption padding removal is not implemented as side- channel resistant. This iss...

Rocky Linux 9 [CIQ] Security Update: cups / cups-client / cups-client-debuginfo / cups-debuginfo / etc (crlsa-2023_4838)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234838 advisory. cups: Information leak through Cups-Get-Document operation CVE-2023-32360 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9.6 [TuxCare] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-devel / etc (ALMALINUX9.6:CLSA-2026:1783597433)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783597433 advisory. - ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface...

AlmaLinux 9.2 [TuxCare] Security Update: cups-filters / cups-filters-devel / cups-filters-libs (ALMALINUX9.2:CLSA-2025:1744716861)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744716861 advisory. - CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited...

AlmaLinux 9.6 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778674879)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778674879 advisory. - A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device ...

AlmaLinux 9.2 [TuxCare] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-devel / etc (ALMALINUX9.2:CLSA-2026:1785840756)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785840756 advisory. - ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface IPM...

Rocky Linux 8 [CIQ] Security Update: libserf / libserf-debuginfo / libserf-debugsource / utf8proc / etc (crlsa-2020_4712)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204712 advisory. subversion: remotely triggerable DoS vulnerability in svnserve 'get-deleted-rev' CVE-2018-11782 Tenable has extracted the preceding description block directly from...

PT-2026-105169

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp uri:remove credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GE...

PT-2026-103931

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description Internal state files in the mod dav fs module are accessible to external parties. This allows a remote client to read WebDAV dead properties of resources they are not authorized to...

CVE-2026-58415: Files or Directories Accessible to External Parties

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

CVE-2026-103591

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repourl parameter. Attackers can supply a non-URL repourl value to bypass path containment checks and read any file accessible to the API process by...

CVE-2026-103591 DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repourl parameter. Attackers can supply a non-URL repourl value to bypass path containment checks and read any file accessible to the API process by...

PT-2026-103630

Name of the Vulnerable Software and Affected Versions DeepWiki-Open versions prior to commit d92819a Description An unauthenticated arbitrary file read issue exists in the 'GET /codemap/file' endpoint. By providing a non-URL value to the repo url parameter, an attacker can bypass path containment...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1778234216)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778234216 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent...

MAL-2026-17288 Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

EUVD-2026-88581

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal...

PT-2026-102767

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A heap-buffer-overflow occurs when a DHCP server or a malicious actor on the local area network responds to a DISCOVER message. The issue stems from an incorrect...