Photon OS 5.0: Frr PHSA-2025-5.0-91-0687

An update of the frr package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0687. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69779

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the Linux kernel within the TCP implementation. When a PSP Policy-Based Routing policy failure happens in both IPv4 and IPv6 receive paths, the system fails to...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to Object.prototype.proxy being able to influence the Node HTTP adapter through an un-rehardened request configuration, allowing an attacker who can pollute the prototype to route requests through an attacker-controlled proxy...

CVE-2026-66061

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the...

EUVD-2026-54654

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user...

SUSE CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the route rule matching. An attacker can gain unauthorized access to protected pages and sensitive data by crafting requests to mixed-case paths that bypass authentication middleware. Workaround This...

Incorrect Authorization

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Incorrect Authorization in the route rule matching. An attacker can gain unauthorized access to protected pages and sensitive data by crafting requests to mixed-case paths that...

ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...

UBUNTU-CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-55707

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...

EUVD-2026-53046

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...

CVE-2026-55707

CVE-2026-55707 affects OpenStack Neutron before 28.0.2. The subnetpool onboarding API (PUT /v2.0/subnetpools/{id}/onboard_network_subnets) does not verify subnet ownership, allowing an authenticated but lower-privileged user to onboard subnets from another project’s shared network into their own ...

CVE-2026-55707

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...

CVE-2026-55707

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...

CVE-2026-55707: Incorrect Authorization

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scop...

Linux Distros Unpatched Vulnerability : CVE-2026-64572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib ent...

PT-2026-67950

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 28.0.2 Description The subnetpool onboarding API fails to verify the ownership of target subnets. This allows an authenticated user to onboard subnets belonging to another project's shared network into their...

Photon OS 5.0: Frr PHSA-2026-5.0-91-0884

An update of the frr package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0884. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...