RockyLinux 9 : cups (RLSA-2026:0312)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0312 advisory. CUPS: Local denial-of-service via cupsd.conf update and related issues CVE-2025-61915 cups: Slow client communication leads to a possible DoS attack...

Security Updates for Microsoft Word Products C2R (January 2026)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. CVE-2026-20944, CVE-2026-20948 Note that Nessus has not tested fo...

TencentOS Server 3: luksmeta (TSSA-2025:0989)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0989 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Security Updates for Microsoft Office Products C2R (January 2026)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Remote code execution vulnerabilities that attackers can exploit to bypass authentication and execute unauthorized arbitrary commands. CVE-2026-20952, CVE-2026-20953 - A privilege...

Fedora 42 : composer (2026-13b4dbe546)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-13b4dbe546 advisory. Version 2.9.3 - 2025-12-30 Security: Fixed ANSI sequence injection GHSA-59pp-r3rg-353g / CVE-2025-67746 Fixed COMPOSERNOSECURITYBLOCKING env var not being...

WordPress Crush.pics Image Optimizer plugin <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Settings Update vulnerability discovered by ChamlaVic in WordPress Plugin Crush.pics Image Optimizer versions = 1.8.7...

TYPO3 CMS Allows Broken Access Control in Edit Document Controller

Problem By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a...

CVE-2026-21265

CVE-2026-21265 describes a Secure Boot bypass tied to expiration of Microsoft root certificates in the UEFI KEK/DB chain. Affected certificates include KEK CA 2011 (expires 2026-06-24), UEFI CA 2011 (expires 2026-06-27), and Windows Production PCA 2011 (expires 2026-10-19). The vulnerability aris...

Important: Red Hat Security Advisory: VolSync v0.14 security fixes and container updates

VolSync v0.14 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

January 13, 2026—KB5073696 (Monthly Rollup)

None None...

January 13, 2026—KB5073379 (OS Build 26100.32230)

None None...

January 13, 2026—KB5073455 (OS Build 22631.6491)

None None...

January 13, 2026—KB5073724 (OS Builds 19045.6809 and 19044.6809)

None None...

January 13, 2026—KB5074109 (OS Builds 26200.7623 and 26100.7623)

None None...

January 13, 2026—KB5073698 (Monthly Rollup)

None None...

Secure Boot Certificate Expiration Security Feature Bypass Vulnerability

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes...

January 13, 2026—KB5073723 (OS Build 17763.8276)

None None...

January 13, 2026—KB5073450 (OS Build 25398.2092)

None None...

CVE-2025-68800

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrummr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex instead of RTNL to protect the multicast route list, so that it will not change while the driver periodically traverse...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved memory handling. This issue is fixed in Safari 26.1, iOS 18.7.2, and iPadOS 18.7.2; iOS 26.1 and iPadOS 26.1; macOS Tahoe 26.1; tvOS 26.1; visionOS 26.1; and watchOS 26.1. Processing maliciously crafted web content may lead to memory corruption...