PT-2026-52927

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture early kernel mapping process. For 4K pages, the early kernel mapping may utilize 2MB block entries, but kernel segments are only 64KB aligned...

PT-2026-52861

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

PT-2026-52758

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

PT-2026-52906

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET KEY BASE=OVERWRITE ME as the default Rails master key. Combined with cookies serializer = :marshal, this gives any logged-in user a deterministic...

PT-2026-52789

Unauthenticated Broken Access Control in Flash & HTML5 Video = 2.11.0 versions...

PT-2026-52761

Unauthenticated Cross Site Scripting XSS in perfmatters = 2.6.3 versions...

PT-2026-52731

Unauthenticated Broken Access Control in Gutenverse Companion = 2.5.0 versions...

PT-2026-52814

Contributor SQL Injection in Restaurant Menu by MotoPress = 2.4.10 versions...

PT-2026-52793

Author Cross Site Scripting XSS in Featured Image = 2.1 versions...

PT-2026-52886

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.35.11 Envoy versions prior to 1.36.7 Envoy versions prior to 1.37.3 Envoy versions prior to 1.38.1 Description The OAuth2 HTTP filter uses AES-256-CBC in its encrypt and decrypt functions without an authentication tag...

PT-2026-52788

Unauthenticated Cross Site Scripting XSS in weMail = 2.1.2 versions...

SUSE SLES15 Security Update : apptainer (SUSE-SU-2026:2609-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2609-1 advisory. This update for apptainer fixes the following issues - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for...

PT-2026-52710

Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description Broken access control allows users with the Subscriber role to perform unauthorized actions within the plugin. Recommendations Update Restaurant Menu by MotoPress to version...

PT-2026-52885

Name of the Vulnerable Software and Affected Versions Envoy versions 1.34.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 Description The PROXY Protocol v2 header generator emits Type-Length-Values TLVs that exceed t...

PT-2026-52746

Unauthenticated Privilege Escalation in Paytium = 5.0.2 versions...

PT-2026-52862

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

Oracle Linux 9 : bind (ELSA-2026-24367)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-24367 advisory. - Fix GSS-API resource leak CVE-2026-3039 - Invalid handling of CLASS != IN CVE-2026-5946 Tenable has extracted the preceding description block direct...

SUSE SLES12 Security Update : containerd (SUSE-SU-2026:2640-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2640-1 advisory. This update for containerd fixes the following issues - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation...

Debian dla-4653 : openvpn - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4653 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4653-1 [email protected]...

SUSE SLES16: dovecot24 / dovecot24-backend-mysql / dovecot24-backend-pgsql / etc (SUSE-SU-2026:22185-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22185-1 advisory. This update for dovecot24 fixes the following issues - CVE-2026-27851: lib-var-expand: safe filter leaks to all following pipeline...