GHSA-RCQC-6CW3-H962 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, cassandra-fips, trino, nacos-docker, spark, thingsboard, kafka, ruby3.3-jrjackson, scala, logstash-fips, apache-tika, management-api-for-apache-cassandra-4.1, nacos, apache-camel-karavan-devmode, apache-activemq-fips, apache-nifi,...

CVE-2026-54513 vulnerabilities

Vulnerabilities for packages: trino, kafka, ruby3.3-jrjackson, logstash-fips, jmeter, kafka-bridge, apache-nifi, spdx-tools-java, akhq, flyway-fips, zookeeper-fips, request-9047-keycloak-fips, ruby4.0-jrjackson, nextflow, cassandra-reaper, airbyte-server, gradle, jenkins-plugin-manager,...

CVE-2026-54516 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, cassandra-fips, trino, nacos-docker, spark, thingsboard, kafka, ruby3.3-jrjackson, scala, logstash-fips, apache-tika, management-api-for-apache-cassandra-4.1, nacos, apache-camel-karavan-devmode, apache-activemq-fips, apache-nifi,...

CVE-2026-54517 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, cassandra-fips, trino, nacos-docker, spark, thingsboard, kafka, ruby3.3-jrjackson, scala, logstash-fips, apache-tika, management-api-for-apache-cassandra-4.1, nacos, apache-camel-karavan-devmode, apache-activemq-fips, apache-nifi,...

GHSA-RMJ7-2VXQ-3G9F vulnerabilities

Vulnerabilities for packages: trino, kafka, ruby3.3-jrjackson, logstash-fips, jmeter, kafka-bridge, apache-nifi, spdx-tools-java, akhq, flyway-fips, zookeeper-fips, request-9047-keycloak-fips, ruby4.0-jrjackson, nextflow, cassandra-reaper, airbyte-server, gradle, jenkins-plugin-manager,...

GHSA-9FXM-VC8V-HJ55 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, cassandra-fips, trino, nacos-docker, spark, thingsboard, kafka, ruby3.3-jrjackson, scala, logstash-fips, apache-tika, management-api-for-apache-cassandra-4.1, nacos, apache-camel-karavan-devmode, apache-activemq-fips, apache-nifi,...

PT-2026-52584

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description There are certificate policy and RFC 8446 compliance concerns due to the continued acceptance of SHA-1 and MD5 hashing algorithms during certificate processing...

PT-2026-52545

Name of the Vulnerable Software and Affected Versions NewsBlur versions prior to 14.5.0 Description Authenticated users can perform server-side request forgery SSRF via the 'add url' endpoint. This occurs because the application fails to filter private IP addresses, allowing arbitrary server...

UBUNTU-CVE-2026-12490

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port and not the tls-auth-port or over over TCP over the regular...

Linux Distros Unpatched Vulnerability : CVE-2026-53072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock...

PT-2026-52456

Content injected to PDF rendering contexts could, in many places, include HTML content including tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server a...

PT-2026-52353

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs during split 6 GHz scanning when the cfg80211 scan function fails. The rdev-int scan req variable is leaked because the cleanup process in cfg80211 scan done is...

PT-2026-52594

Name of the Vulnerable Software and Affected Versions Apicurio Registry affected versions not specified Description A flaw exists where the WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, a user with...

PT-2026-52368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the OP-TEE driver of the Linux kernel. This occurs when a client task terminates while a supplicant is still processing its request. Because the client m...

Oracle Linux 9 : tomcat (ELSA-2026-26323)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26323 advisory. - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 - Resolves: Tomcat: Cloud membership for clustering...

CVE-2026-55454

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by...

CVE-2026-49979

Appsmith prior to version 1.99 exposes a vulnerability in the POST /api/v1/admin/send-test-email endpoint. An attacker can supply smtpHost and smtpPort values to establish a raw JavaMail TCP connection, bypassing WebClientUtils.IP_CHECK_FILTER (which only applies to Spring WebClient HTTP requests...

CVE-2026-55454 Appsmith: Caddy admin API exposed without authentication

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by...

OPENSUSE-SU-2026:21054-1 Security update for dracut

This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: - Update to version 059+suse.722.gdd9d67ff5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...

CVE-2026-55455

CVE-2026-55455 affects Appsmith prior to version 2.1. The issue is an SSRF: the outbound HTTP host filter in WebClientUtils used by the REST API and GraphQL datasource plugins validates hosts against an exact-match denylist, while a broader address-class check (loopback, any-local, link-local, fc...