Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery

Ignite Realtime Openfire through version 4.4.2 allows attackers to send arbitrary HTTP GET requests in FaviconServlet.java, resulting in server-side request forgery. id: CVE-2019-18394 info: name: Ignite Realtime Openfire =4.4.3 to fix this vulnerability. reference: -...

PT-2026-61390

In the Linux kernel, the following vulnerability has been resolved: irq work: Fix use-after-free in irq work single on PREEMPT RT On PREEMPT RT, non-HARD irq work runs in per-CPU kthreads via run irq workd, so irq work sync uses rcuwait to wait for BUSY==0. After irq work single clears BUSY via...

RHSA-2026:41236 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Bulletin has no description...

RHEL 8 : kernel-rt (RHSA-2026:39180)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39180 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

SUSE-SU-2026:2855-1 Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.37 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats...

EUVD-2026-42625

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decodetoken without the Redis-backed...

CVE-2026-59219

Open WebUI 0.9.0–0.10.0: with Redis configured, the terminal websocket first-message authentication used decode_token without a Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. Fixed in version 0.10.0. This affects realtime endpo...

PT-2026-56884

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.9.x Description When Redis is configured, the authentication process for Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message uses the decode token function withou...

RHSA-2026:36365 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

SUSE-SU-2026:22517-1 Security update for kernel-livepatch-MICRO-6-0-RT_Update_26

This update for kernel-livepatch-MICRO-6-0-RTUpdate26 fixes the following issues: - New livepatch SLE Micro 6.0/6.1 kernel update 26...

CVE-2026-53326

A flaw was found in the Linux kernel's debugobjects subsystem. During early boot on a debug PREEMPTRT kernel on an ARM64 system, interrupts can occur before the scheduler is fully enabled. In this specific window, the hard interrupt context handler may attempt to fill a pool, which can lead to a...

CVE-2026-53326

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't call fillpool in early boot hardirq context When booting a debug PREEMPTRT kernel on an ARM64 system, a "inconsistent HARDIRQ-ON-W - IN-HARDIRQ-W usage" lockdep warning message was reported to the console...

RockyLinux 8 : kernel-rt (RLSA-2026:27812)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:27812 advisory. kernel: selinux: fix overlayfs mmap and mprotect access checks CVE-2026-46054 Tenable has extracted the preceding description block directly from the RockyLinux...

CVE-2026-9162 Global session revocation does not invalidate active WebSocket connections

Mattermost versions 11.7.x = 11.7.0, 11.6.x = 11.6.2, 11.5.x = 11.5.5, 10.11.x = 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continu...

Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join

Summary A cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification channel and passively receive that organization's events. Impact The notification gateway's JWT handshake joined a...

RHSA-2026:26462 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

RHSA-2026:26428 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

Malicious code in @mastra/voice-openai-realtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 623d77007529d1601a2da2b0ff1fc002dfa42282411ba1350b5bc720316d6c0f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6049 Malicious code in @mastra/voice-openai-realtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 623d77007529d1601a2da2b0ff1fc002dfa42282411ba1350b5bc720316d6c0f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-50595

Name of the Vulnerable Software and Affected Versions Daytona versions 0.101.0 through 0.184.0 Description A cross-tenant authorization flaw exists in the notification WebSocket gateway of the Daytona API service apps/api NestJS application. The JWT handshake joins a client-supplied organization...