Oracle Linux 8 : .NET / 8.0 (ELSA-2026-68316)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-68316 advisory. 8.0.131-1.0.1 - Add support for Oracle Linux 8.0.131-1 - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252244 Tenable has extracted the...

openssl security update

3.5.8-1.0.1 - Replace upstream references Orabug: 34340177 3.5.8.openela.0.1 - Add OpenELA specific changes 1:3.5.8-1 - Rebase to OpenSSL 3.5.8 Resolves: RHEL-242945 Resolves: RHEL-246260 Resolves: RHEL-246284 Resolves: RHEL-246319 Resolves: RHEL-246439 Resolves: RHEL-246443 Resolves: RHEL-246447...

CVE-2026-56795: Uncontrolled Search Path Element

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution...

RHEL 7 : freerdp (RHSA-2026:68707)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68707 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

CVE-2026-86003

A flaw was found in CoreDNS. The DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners do not properly validate incoming DNS update requests. An unauthenticated client can send a specially crafted DNS update RFC 2136 UPDATE that CoreDNS forwards to an upstream DNS server. If...

CVE-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-82561 Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

AZL-101835 CVE-2026-86003 affecting package coredns 1.11.4-21

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-86003

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-86003

CoreDNS (a DNS server written in Go) prior to 1.14.7 fails to enforce the dns.DefaultMsgAcceptFunc request policy on its DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners. Unlike the UDP, TCP, and DNS-over-TLS paths, these listeners call dns.Msg.Unpack without that polic...

CVE-2026-86003 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-86003 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-86003 CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CLSA-2026-1789583743 TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 15 org.springframework.security packages to address 3 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.7...

CVE-2026-47094

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

EUVD-2026-80933

SIMAC MyPHR 1.1 contains an insecure direct object reference IDOR vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary...

CVE-2026-86358

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-71180

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-71182

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

CVE-2026-71181

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...