Oracle Linux 8 : ELSA-2026-64809-0: / expat (ELSA-2026-648090)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648090 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219 Tenable has extracted the preceding description block...

Kibana 9.4.x < 9.4.5 Missing Authorization (ESA-2026-147)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-147 advisory. - Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization contro...

CVE-2026-76009: Improper Authentication

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21793-1)

"The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21793-1 advisory. Changes in hauler: - update to 2.1.0 bsc1265425, CVE-2026-41888: v2.1.0 is a minor release built on the containerd- native foundation laid down...

CVE-2026-86739: Unchecked Return Value

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

Oracle Linux 9 : ELSA-2026-64812-0: / expat (ELSA-2026-648120)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648120 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219 Tenable has extracted the preceding description block...

Kibana 8.x < 8.19.21 / 9.0.3 < 9.4.6 Missing Authorization (ESA-2026-155)

The version of Kibana installed on the remote host is 8.x prior to 8.19.21, or 9.0.3 prior to 9.4.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-155 advisory. - Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential...

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the store process. An attacker can overwrite arbitrary existing files writable by the PHP process with partially controlled content by supplying a crafted export path, potentially leading to...

CVE-2026-77091

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

EUVD-2026-72723

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

CVE-2026-77091 DataCube Security Feature Bypass

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

CVE-2026-77091 DataCube Security Feature Bypass

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

CVE-2026-77091

Commvault DataCube contained a path traversal flaw that could bypass security feature enforcement . The CVSS 4.0 score is 8.5 (HIGH) , with a local attack vector requiring low privileges and no user interaction, resulting in high impact to confidentiality, integrity, and availability of the vulne...

CLEANSTART-2026-PX76402 etcd is a distributed key-value store for the data of a distributed system

Multiple security vulnerabilities affect the kubernetes package. etcd is a distributed key-value store for the data of a distributed system. See references for individual vulnerability details...

PT-2026-87044

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

expat security update

2.7.3-59 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog 2.7.3-58 - Fix CVE-2026-50219: forbid XMLParserFree/Reset from handlers 2.7.3-57 - expat: backport CVE-2026-45186 fix attribute collision check DoS 2.7.3-56 - Rebase to 2.7.3 and add VCS tag Thu Jun 05 2025...

CVE-2026-77091: Improper Limitation of a Pathname to a Restricted Directory

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

Important: redis:6 security update

Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, ...

Security update for hauler (moderate)

openSUSE security update: security update for hauler ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21793-1 Rating: moderate References: bsc1265425 bsc1276124 bsc1276651 bsc1277965 Cross-References: CVE-2026-37236 CVE-2026-41178 CVE-2026-41888...