Security update for ruby3.4

This update for ruby3.4 fixes the following issues CVE-2026-42258: Net:IMAP: Command Injection via Symbol Arguments bsc1268011. CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument bsc1268337. CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw...

[SECURITY] Fedora 43 Update: rust-cargo-rpmstatus-0.2.5-2.fc43

Cargo-tree for RPM packaging...

[SECURITY] Fedora 43 Update: rust-opendal-0.55.0-2.fc43

OpenDAL is an Open Data Access Layer that enables seamless interaction with diverse storage services...

[SECURITY] Fedora 43 Update: mingw-glib2-2.86.5-2.fc43

MinGW Windows Glib2 library...

PT-2026-60810

Name of the Vulnerable Software and Affected Versions Sangoma Switchvox versions prior to 8.4.0.2 Description An unauthenticated SQL injection exists in the /pa endpoint, which processes XML content beginning with . The issue occurs because the PhoneIP variable is concatenated directly into...

Oracle Linux 10 : python3.14 (ELSA-2026-40856)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40856 advisory. - Security fix for CVE-2026-15308 Resolves: RHEL-193775 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

PT-2026-60964

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.1.13 Apache Traffic Server versions 10.0.0 through 10.1.2 Description An uncontrolled resource consumption issue exists in Apache Traffic Server. This flaw allows for a denial of service via stall...

PT-2026-60854

Name of the Vulnerable Software and Affected Versions Generic OEM UZ801 v2.1 4G LTE Router version 3.4.3 Description A remote attacker can execute arbitrary code through the sbin/adbd component. Recommendations At the moment, there is no information about a newer version that contains a fix for...

Fedora 43 : perl-DBI (2026-71d7e4d1da)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-71d7e4d1da advisory. 1.650 bump - Fix CVE-2026-14739, CVE-2026-14740 and CVE-2026-14380 Tenable has extracted the preceding description block directly from the Fedora...

Oracle Linux 10 : golang-github-openprinting-ipp-usb (ELSA-2026-35832)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-35832 advisory. - rebuilt with golang-1.26.4-1.el102 to fix CVE-2026-33811, CVE-2026-27145 - rebuilt with golang-1.26.3-4.el102 to fix CVE-2026-32281 Tenable has...

Fedora 43 : mingw-glib2 (2026-8e39f35701)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8e39f35701 advisory. Backport fix for CVE-2026-58016. ---- Update to glib-2.86.5. Tenable has extracted the preceding description block directly from the Fedora security...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : NTFS-3G vulnerabilities (USN-8554-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8554-1 advisory. It was discovered that NTFS-3G had a heap buffer overflow when reading certain NTFS images. A local attacker could possibly use...

CVE-2026-15997

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/nativec/arm/sha/shake.C,...

CVE-2026-15997

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/nativec/arm/sha/shake.C,...

CVE-2026-15997 Native ARM SHA3 / SHAKE `restoreFullState` fails to detect size_t underflow in a crafted encoded state

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/nativec/arm/sha/shake.C,...

CVE-2026-15997

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/nativec/arm/sha/shake.C,...

EUVD-2026-45065

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables e.g., KERNELXXX into Kubernetes manifests without YAML-aware escapin...

CVE-2026-44177 Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user object...

DEBIAN-CVE-2026-47087

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...

remorses/genql code injection

RISK EVALUATION remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is...