Moderate: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 For more details about...

Moderate: java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 For more details about the...

CVE-2026-74952

Privilege escalation in the Application Update component. This vulnera...

yggdrasil security update

0.4.9.2-2 - Rebuild yggdrasil against updated golang...

PT-2026-78440

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description An issue exists involving the deserialization of untrusted data. A low privileged attacker with local access could exploit this to achieve elevation of privileges. Deserialization is...

PT-2026-78479

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description An Improper Restriction of XML External Entity Reference exists, which allows a low privileged attacker with local access to potentially achieve elevation of privileges and Server-sid...

PT-2026-78473

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description Missing authorization allows a low privileged attacker with local access to achieve elevation of privileges. Recommendations Update Dell Command Update DCU to version 5.7.1 or later...

ALSA-2026:55781 Moderate: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 For more details about...

OPENSUSE-SU-2026:11554-1 postgresql16-16.15-1.1 on GA media

These are all security issues fixed in the postgresql16-16.15-1.1 package on the GA media of openSUSE Tumbleweed...

ALSA-2026:56971 Important: perl-Date-Manip security update

Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a data a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian...

UBUNTU-CVE-2026-74952

Privilege escalation in the Application Update component. This vulnera...

PT-2026-78641

Name of the Vulnerable Software and Affected Versions Ozols Grupa OZOLS versions prior to 1.1.1233 Description The software contains a flaw in its automatic update channel, specifically affecting the OzolsSQL client update path, the serv update.vbs file, and the update SQL Server Agent job using...

ALSA-2026:55787 Moderate: java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 For more details about the...

OPENSUSE-SU-2026:11552-1 postgresql14-14.24-1.1 on GA media

These are all security issues fixed in the postgresql14-14.24-1.1 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 10 : mysql8.4 (ELSA-2026-56007)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-56007 advisory. 8.4.11-1 - Rebase to 8.4.11 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

CVE-2026-70713

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite component: General Ledger Update Transform, Reports. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-52817 Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who...

CVE-2026-52817

In Linuxfabrik Monitoring Plugins prior to 5.1.0, the Debian.sudoers file allowed the nagios/icinga account to run /usr/bin/apt-get as root with unrestricted arguments. An attacker with the monitoring account can execute sudo apt-get update -o APT::Update::Pre-Invoke::="/bin/sh" to obtain a root ...

GHSA-V5RC-CPWC-CFPR Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...