RHEL 8 : kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_124_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_89_1, and kpatch-patch-4_18_0-477_97_1 (RHSA-2026:16210)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16210 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module ...

TencentOS Server 3: ruby:2.5 (TSSA-2026:0656)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0656 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

glibc security update

2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E. Marchesi Oracle history: Jul-15-2026 Cupertino Miranda - 2.39-124.0.1 - Forward port Oracle changes to 2.39-124. - Reviewed-by: Jose E. Marchesi May-19-2026 Cupertino Miranda - 2.39-121.0.1 - Forward port Oracle change...

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 stable and 1.31.3 mainline, and in NGINX Plus 37.0.3.1; anyone on an...

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access SMA 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026. Cybersecurity company Volexity is tracking the activity under the...

CVE-2026-53375

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

CVE-2026-53375

CVE-2026-53375 affects the Linux kernel, specifically the drm/amdgpu/vce component. The issue arises during patching when only one of the lo/hi address parts is valid, which could cause a bad address to be written to firmware. The vulnerability is described as resolved, with linked kernel commits...

CVE-2026-53375

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

GHSA-4R4F-GG25-RMG5 plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

Oracle Linux 10 : image-builder (ELSA-2026-22937)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-22937 advisory. 58-1.0.1 - v58 with osbuild/images v0.256.0 with OL support patches - Add Azure image type - Correct dnf-plugin-spacewalk package filters 56-1.0.1 -...

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Impact The toabsolutenormalizedpath function security.lua:28-43 does not collapse redundant path separators // → /. On Linux, //etc/passwd is equivalent to /etc/passwd POSIX path semantics, but iscriticalpath fails to match the double-slash variant because //etc/passwd does not start with /etc/...

Tanium Server 7.7.3.x < 7.7.3.8298 / 7.8.2.x < 7.8.2.1198 / 7.8.4.x < 7.8.4.1327 DoS (TAN-2026-016)

The version of Tanium Server installed on the remote host is 7.7.3.x prior to 7.7.3.8298, 7.8.2.x prior to 7.8.2.1198, or 7.8.4.x prior to 7.8.4.1327. It is, therefore, affected by a denial of service vulnerability: - A denial of service vulnerability in Tanium Server could allow an...

image-builder security update

58-1.0.1 - v58 with osbuild/images v0.256.0 with OL support patches - Add Azure image type - Correct dnf-plugin-spacewalk package filters 56-1.0.1 - v56 with osbuild/images v0.254.0 with OL support patches - Add gce gcp image type to OL distro types 55-1.0.1 - v55 with osbuild/images v0.252.0 wit...

GHSA-XG43-5579-QW6V adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

Impact adawolfa/isdoc reads ISDOC invoices from ISDOCX ZIP archives and from PDF files with embedded ISDOC documents and supplements. Affected versions inflate ZIP entries and read embedded files without validating their uncompressed size, so a small crafted file can amplify into gigabytes: -...

Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws

Mozilla has released updates to address two critical flaws in Firefox for which it warned that exploit code has been published. The vulnerabilities are listed below - CVE-2026-15718 , an invalid pointer in the JavaScript: WebAssembly component CVE-2026-15719 , a site isolation in the DOM:...

CVE-2026-48125

A flaw was found in UAParser.js, a JavaScript library for detecting client information. A remote attacker can exploit this vulnerability by sending a specially crafted Sec-CH-UA-Model header when the application uses the Client Hints API. This can cause excessive CPU usage due to a regular...

CVE-2026-47423

A flaw was found in DOMPurify, a DOM-only cross-site scripting XSS sanitizer. Due to the default allowance of selectedcontent, a remote attacker could craft a malicious payload that, after initial sanitization, could be re-cloned by browsers, leading to the execution of unsanitized markup. This...

Oracle Linux 10 : gstreamer1-plugins-bad-free, / gstreamer1-plugins-base, / gstreamer1-plugins-good, / and / gstreamer1-plugins-ugly-free (ELSA-2026-19024)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19024 advisory. - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156114, RHEL-156172 - Add patch for CVE-2026-2921 Resolves: RHEL-156122...

CVE-2026-48561

creationtimestamp| type| source ---|---|--- 2026-07-14 18:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmu6jsugc22 2026-07-14 22:02:10+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-14 22:05:06+00:00| seen|...

CVE-2026-56155

creationtimestamp| type| source ---|---|--- 2026-07-14 18:00:28+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3d723813-809e-42df-ae57-9da291055398 2026-07-14 18:20:36+00:00| seen| https://bsky.app/profile/cvesentinel.bsky.social/post/3mqmt3ncdul23...