Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: samba (UTSA-2026-100776)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100776 advisory. Unity Link Advisory UTSA-2026-100776 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

The vulnerability of the Apache Tomcat application server, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the EncryptInterceptor module in the Apache Tomcat application server allows a hacker to perform a replay attack.

The vulnerability of the EncryptInterceptor module in the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to carry out a replay attack...

RHEL 10 : 389-ds-base (RHSA-2026:55425)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55425 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDA...

Oracle Linux 10 : curl (ELSA-2026-55432)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55432 advisory. - fix proxy environment variable change detection CVE-2026-8927 - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

ALSA-2026:55424 Important: 389-ds-base security update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status...

PT-2026-76722

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description The REST API server contains a flaw in its safety check designed to prevent the combination of cors credentials=True and an unrestricted CORS origin allowlist. The check in glances/outputs/glances...

PT-2026-76808

Name of the Vulnerable Software and Affected Versions SkyPilot affected versions not specified Description An authorization bypass exists where the system fails to validate if authenticated users have the necessary entitlements to grant administrator roles when updating service account permission...

RockyLinux 9 : curl (RLSA-2026:55439)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55439 advisory. curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl: Information disclosure via...

RHEL 8 : 389-ds:1.4 (RHSA-2026:55530)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55530 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

PT-2026-76825

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0 Description Authenticated users can bypass experiment-level READ permissions to access arbitrary files from another user's artifact directory. The issue occurs because the validate source run and validate source...

RockyLinux 8 : 389-ds:1.4 (RLSA-2026:55530)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55530 advisory. 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check CVE-2026-11770 389-ds-base: 389-ds-base: NULL pointer dereference i...

RHEL 9 : 389-ds-base (RHSA-2026:55423)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55423 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

UBUNTU-CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

ALSA-2026:55432 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Information disclosure due to uncleared proxy authentication state CVE-2026-8927 For more details about the security...

PT-2026-76635

openssl encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without...

PT-2026-76694

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.3.156085 JetBrains YouTrack versions prior to 2026.1.13913 JetBrains YouTrack versions prior to 2026.2.18112 Description An unauthenticated attacker can download database backups by utilizing a shared...

PT-2026-76804

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTH ENABLED=true but the undocumented, defaultless INTERNAL SERVICE SECRET environment variable is unset, the is internal request check in src/memos/api/middleware/auth.py fails open:...

RHEL 9 : 389-ds-base (RHSA-2026:55426)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55426 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...