SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3156-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3156-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: -...

TencentOS Server 3: httpd:2.4 (TSSA-2026:0732)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0732 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Oracle MySQL Cluster 9.x < 9.7.2 (July 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are...

PT-2026-63561

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption when that Server Action...

PT-2026-63380

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.15.0 through 1.25.1 Description A use-after-free issue exists in the handling of DNS-over-TLS DoT forwarded queries. The TLS server name is tied to the lifetime of the serviced query struct but is also referenced ...

PT-2026-63402

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation...

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability. This vulnerability ...

PT-2026-63460

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A user with read access can cause a Denial of Service DoS by executing a specifically crafted query. By using expressions that generate large arrays, the system...

PT-2026-63481

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

PT-2026-63482

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

PT-2026-63545

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description The OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous Online Certificate Status Protocol OCSP validation...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

PT-2026-63475

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

PT-2026-63556

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Crafted requests targeting applications using App Router with at least one Server Action can cause excessive CPU usage, which blocks the processing of...

PT-2026-63536

Name of the Vulnerable Software and Affected Versions Search API Autocomplete versions 0.0.0 through 1.12.0 Description Improper neutralization of input during web page generation allows Reflected Cross-site Scripting XSS, a flaw where malicious scripts are injected into a web page and reflected...

PT-2026-63403

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests...

PT-2026-63470

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Improper handling of DBPointer objects during BSON serialization the process of converting data into a binary format in the server-side JavaScript engine can lead to internal process memory...

PT-2026-63412

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description BIND may accept incorrec...

PT-2026-63564

Name of the Vulnerable Software and Affected Versions Next.js versions 14.1.1 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host, leading to...