Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2026-3844 (ALAS-2026-3844)

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300069.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3844 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject...

RHEL 9 : Satellite 6.17.10 Async Update (Important) (RHSA-2026:50222)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50222 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

SUSE SLES12 Security Update : google-guest-agent (SUSE-SU-2026:3439-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3439-1 advisory. This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

SUSE-SU-2026:23051-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

SUSE-SU-2026:3472-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: Update golang.org/x/net to v0.57.0...

SUSE-SU-2026:3471-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266604. Changes for google-cloud-sap-agent: - Update golang.org/x/net to v0.57....

SUSE-SU-2026:23077-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383

The CVE-2026-15383 entry concerns the Blog Floating Button WordPress plugin (versions up to and including 1.4.20). Affected component: the visitor User-Agent header is not sanitized/escaped when stored via an unauthenticated tracking REST endpoint and later rendered unescaped in an administrator ...

EUVD-2026-52174

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

[SECURITY] Fedora 43 Update: exim-4.99.5-1.fc43

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

CVE-2026-67307

Wazuh 5.0.0-beta1 is affected by a vulnerability in inventory-sync Start FlatBuffer messages where cluster_name and cluster_node are not validated or overridden, while agentid is validated. This enables a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerab...

EUVD-2026-51833

Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...

CVE-2026-14197

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

WordPress Fluent Support plugin < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment vulnerability

Agent+ Arbitrary Ticket Customer Reassignment vulnerability discovered by Mustafa Ahmed in WordPress Plugin Fluent Support versions 2.3.1...

CVE-2026-14197

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...