ROS-20261023-73-0219

The vulnerability in Jenkins is related to errors in handling HTTP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261023-73-0221

The vulnerability in Jenkins is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform CSRF attacks remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-114609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local...

Linux Distros Unpatched Vulnerability : CVE-2026-115449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific...

PT-2026-122126

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket in goobi-viewer-core accepts download requests from unauthenticated users...

PT-2026-122093

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the...

Cisco Expressway Series Information Disclosure (cisco-sa-expressway-inf-disc-vvYqgSTS)

According to its self-reported version, Cisco Expressway Series is affected by an information disclosure vulnerability. - A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due t...

Linux Distros Unpatched Vulnerability : CVE-2026-93521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests CVE-2026-93521 Note that Nessus relies on the presence of th...

Curl 8.11.0 < 8.23.0 HSTS Policy Loss

The version of curl installed on the remote host is 8.11.0 prior to 8.23.0. It is, therefore, affected by a policy handling vulnerability: - Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the...

CVE-2026-110491

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be...

CVE-2026-101780

A flaw was found in the MySQL Server X Plugin component. An authenticated remote attacker with low privileges and network access can exploit this vulnerability through network protocol requests. Successful exploitation allows the attacker to cause the database server to hang or repeatedly crash,...

DEBIAN-CVE-2026-115449

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

CVE-2026-115449

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

CVE-2026-115449

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest ...

CVE-2026-115419

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent...

CVE-2026-115419

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent...

CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent...

CVE-2026-115419

The Amazon Strands Agents SDK (Python version before 1.43.0 and TypeScript version before 1.5.0) contains a vulnerability in the A2A server component where conversation state is not properly isolated between callers. This flaw allows an authenticated remote user to access other tenants' conversat...

CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent...

DEBIAN-CVE-2026-115376

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read othe...