CVE-2026-65638: Improper Neutralization of Special Elements used in an OS Command

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...

PT-2026-89608

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

CVE-2026-87912: Unverified Ownership

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a...

CVE-2026-81051: Security Version Number Mutable to Older Versions

Dell ThinOS 10, versions prior to 260510.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Protection mechanism bypass...

CVE-2026-65639: Improper Neutralization of Special Elements used in an OS Command

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...

CVE-2026-88770: Improper Restriction of Excessive Authentication Attempts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-76059: Protection Mechanism Failure

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...

PT-2026-89420

Berthly 1.3.1 is out now! Adopts apple/container 1.3.1, a security release: CVE-2026-65388 plus five more advisories, some in code Berthly links directly. Authenticated plain-HTTP registries now require HTTPS. https://t.co/nfZ5l6OziT...

PT-2026-89319

🚨 CRITICAL: CVE-2026-88278 CVSS 9.8 GeoVision GV-LPC2211 V1.13 vulnerable to WS-Security token replay attacks. Captured credentials can be reused for unauthorized ONVIF operations. Patch immediately if deployed. CVE Vulnerability PatchNow ThreatIntel https://t.co/WFrJmEw0KA...

vim security update

8.2.2637-26.0.1.el98.21 - Remove upstream references Orabug: 31197557 2:8.2.2637-26.21 - RHEL-253669 CVE-2026-28420 vim: buffer overflow in terminal emulator 2:8.2.2637-26.20 - RHEL-215664 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes 2:8.2.2637-26.19 - RHEL-215684 CVE-2026-59857...

ROS-20260910-73-0101

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data...

Amazon Linux 2 : containerd (ALASECS-2026-136)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-136 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Important: containerd

Issue Overview: Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component...

CVE-2026-75624: Incorrect Authorization

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

OPENSUSE-SU-2026:11740-1 azure-storage-azcopy-10.32.8-1.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.8-1.1 package on the GA media of openSUSE Tumbleweed...

freerdp security update

2:2.11.7-7.7 - Fix RPC gateway fragment size and capacity checks CVE-2026-55193 Resolves: RHEL-247356...

ROS-20260910-73-0057

The vulnerability in Chromium is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to circumvent existing security restrictions...

Fedora 43 : freerdp2 (2026-3fe3e3ae10)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3fe3e3ae10 advisory. Backport several CVE fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

OPENSUSE-SU-2026:11744-1 libpcap-devel-1.10.7-1.1 on GA media

These are all security issues fixed in the libpcap-devel-1.10.7-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 43 : libsoup3 (2026-fce2f41203)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fce2f41203 advisory. Fixes lots of CVEs: see the fixes section for details Tenable has extracted the preceding description block directly from the Fedora security...