PT-2026-82604

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the encryption status of embedded post-quantum cryptography PQC private keys within file metadata. This allows attackers to create files containing unencrypted...

Fedora 43 : openssh (2026-535a408db5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-535a408db5 advisory. Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded Tenable has extracted the preceding description block directly from the Fedora...

CVE-2026-21810

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary...

CVE-2026-21810 HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary...

CVE-2026-21810 HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary...

CVE-2026-21810

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity checking , which could allow an attacker to obtain sensitive information or modify the binary. The CVSS v3.1 base score is 4.4 (Medium) , with a local attack vector and high priv...

DRUPAL-CONTRIB-2026-106

This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...

CVE-2026-80551

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full...

CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-13479 Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler

The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a weak cryptographic algorithm vulnerability due to Paramiko

Summary Paramiko is used by IBM Integrated Analytics System as a Python library providing SSH protocol implementation for secure connections. CVE-2026-44405 affects Paramiko through version 4.0.0, where the rsakey.py module allows the use of the SHA-1 algorithm, which is considered...

kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

A flaw was found in the Linux kernel's netfilter component, specifically within the nftsetpipapoavx2 AVX2 matching functions. This vulnerability occurs when a pipapo set with an 'ipv4 . port' key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as...

Improper Tag-Length Validation

Bouncy Castle for Java is vulnerable to improper tag-length validation. The vulnerability is due to the failure to enforce the required authentication tag length during decryption, which allows an attacker to provide a malformed or truncated authentication tag and potentially bypass the intended...

golang security update

An update is available for golang. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...

golang security update

An update is available for golang. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...

RLSA-2026:22112 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

PT-2026-82363

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...

CVE-2026-54511: Improper Neutralization of CRLF Sequences

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-21810: Download of Code Without Integrity Check

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary...

CVE-2025-70340: Improper Access Control

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...