OESA-2026-1572 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MI...

Fedora 43 : insight (2026-0106837085)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0106837085 advisory. New upstream snapshot. Fixes CVEs 2025-11494, 2025-11495, 2026-2341, 2026-3441, 2026-3442. Fixes CVEs 2025-69644, 2025-69645, 2025-69646. Fixes FTBF...

Fedora 42 : insight (2026-8af0e7ea3e)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8af0e7ea3e advisory. New upstream snapshot. Fixes CVEs 2025-11494, 2025-11495, 2026-2341, 2026-3441, 2026-3442. Fixes CVEs 2025-69644, 2025-69645, 2025-69646. Fixes FTBF...

EUVD-2026-11705

Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS...

CVE-2026-3940

An insufficient policy enforcement flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=470574526...

CVE-2026-3938

An insufficient policy enforcement flaw was found in the Clipboard component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=474763968...

CVE-2026-3929

A side-channel information leakage flaw was found in the ResourceTiming component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=477180001...

CVE-2026-3920

An out of bounds memory access flaw was found in the WebML component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=482875307...

CVE-2026-3917

An use after free flaw was found in the Agents component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=483569512...

CVE-2026-3916

An out of bounds read flaw was found in the Web Speech component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=482828615...

CVE-2026-3910

An inappropriate implementation flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=491410818...

CVE-2026-3909

An out of bounds write flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=491421267...

UBUNTU-CVE-2026-3497

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpktdisconnect on an error, which does not terminate the...

PT-2026-25067

Name of the Vulnerable Software and Affected Versions Undici versions prior to 7.24.0 Description This is an uncontrolled resource consumption issue that can lead to a Denial of Service DoS. When the interceptors.deduplicate function is enabled in vulnerable versions, response data for deduplicat...

Fedora 44 : udisks2 (2026-b8847e1e2c)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b8847e1e2c advisory. Rebase to latest upstream release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Oracle Linux 9 : python3.11 (ELSA-2026-4216)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4216 advisory. 3.11.13-5.1.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-5.1 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and...

Arbitrary Code Injection

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Arbitrary Code Injection via the upstream API requests. An attacker can execute arbitrary code by injecting malicious prompts into requests. Remediation There is no fixed version for...

CVE-2026-29023

Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the router port can proxy requests through the Shannon instanc...

Oracle Linux 9 : python3.12 (ELSA-2026-4165)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4165 advisory. 3.12.12-4.0.1.el97.1 - Remove upstream URL reference 3.12.12-4.1 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299...

python3.11 security update

3.11.13-5.1.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-5.1 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143104 RHEL-143167 RHEL-144890...