EUVD-2026-41498

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can...

CVE-2026-11352

The CVE-2026-11352 issue affects curl/libcurl: a bug in the QUIC UDP receive path discards zero-length UDP datagrams instead of counting them toward the per-call budget, enabling a connected HTTP/3 peer to continuously send empty datagrams and cause a remote denial-of-service against curl or libc...

CVE-2026-11352

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can...

CVE-2022-4990

UNSUPPORTED WHEN ASSIGNED Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of-Life Notice and Driver...

CVE-2022-4990

CVE-2022-4990 affects the ASUS AI Suite 3 driver. The vulnerability arises from improper validation of a specified quantity in input, enabling a local attacker to bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege escalation. The docume...

EUVD-2026-41469

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 4.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Linux Distros Unpatched Vulnerability : CVE-2026-54431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4...

Fedora 43 : apptainer (2026-f8ab642466)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f8ab642466 advisory. Update to upstream 1.5.2. Also fixes CVE-2026-27145 because golang was new enough. Tenable has extracted the preceding description block directly from the...

openQA-5.1782995932.ffeb09be-1.1 on GA media (moderate)

openQA-5.1782995932.ffeb09be-1.1 on GA media Announcement ID: openSUSE-SU-2026:11178-1 Rating: moderate Cross-References: CVE-2026-26996 CVE-2026-27904 CVE-2026-6321 CVSS scores: CVE-2026-26996 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-26996 SUSE : 8.7...

PT-2026-55583

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote attacker can send a specifically crafted message to downgrade the Transport Layer Security TLS protocol to a version that has been disabled in the server configuration. This issue involves th...

Fedora 43 : mysql8.4 (2026-280245e2ea)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-280245e2ea advisory. MySQL 8.4.10 Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-10.html Upstream changelog:...

PT-2026-55537

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM versions prior to 5.5.3 Description An authorization bypass exists in the CalendarDeleteEventController app/Http/Controllers/Calendar/CalendarDeleteEventController.php via the GET '/calendar/event/delete/id' endpoint. A remot...

AlmaLinux 8 : ruby:3.3 (ALSA-2026:33515)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:33515 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol...

Oracle Linux 9 : ruby:3.3 (ELSA-2026-33576)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33576 advisory. - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181693 - Fix information disclosure via MITM attack bypassing TLS in...

MINI-RRC2-3VM2-836J

Bulletin has no description...

CVE-2022-50973

creationtimestamp| type| source ---|---|--- 2026-07-02 19:14:02+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpoqi7o6gp2f 2026-07-02 19:45:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mposbcvlax2n 2026-07-02 20:30:04+00:00| seen|...

GHSA-3VCG-PV95-PQ54 SFTPGo has stored XSS via inline parameter on public shares and user file download

Summary The inline query parameter on the browsable-share file download and on the authenticated user file download suppressed Content-Disposition: attachment, so an HTML file stored in a share or home directory could be served as text/html and execute in SFTPGo's web origin stored XSS. Impact Lo...

GHSA-H64P-8H4R-6GFH SFTPGo has path confinement bypass in public browsable share partial ZIP download

Summary The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's...

CVE-2026-55952

The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tlshandshake13:handlepresharedkey/3, an OfferedPreSharedKeys record with a...

EEF-CVE-2026-55952 TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension

Summary The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls\handshake\1\3:handle\pre\shared\key/3, an OfferedPreSharedKeys...