PT-2026-104577

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when...

CVE-2026-105116: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin,...

JetBrains Rider < 2026.2.1 Unverified Skill Auto-Update

The version of JetBrains Rider installed on the remote host is prior to 2026.2.1. It is, therefore, affected by a vulnerability: - In JetBrains Rider before 2026.2.1 AI Assistant could auto-update third-party skills without user confirmation. CVE-2026-100265 Note that Nessus has not tested for th...

MAL-2026-17444 Malicious code in danz-bails (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: renovate, redisinsight, unleash, rancher-api-ui, dotstatsuite-supercore, verdaccio, actions-runner, sqlpad, tensorflow-gpu-jupyter, langfuse-fips, graalvm, opentelemetry-auto-instrumentations-node, nextcloud-server, foxx-cli, kibana, gitlab-rails-ce-fips, lerna,...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: renovate, redisinsight, unleash, rancher-api-ui, dotstatsuite-supercore, verdaccio, actions-runner, sqlpad, tensorflow-gpu-jupyter, langfuse-fips, graalvm, opentelemetry-auto-instrumentations-node, nextcloud-server, foxx-cli, kibana, gitlab-rails-ce-fips, lerna,...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: renovate, redisinsight, unleash, rancher-api-ui, dotstatsuite-supercore, verdaccio, actions-runner, sqlpad, tensorflow-gpu-jupyter, langfuse-fips, graalvm, opentelemetry-auto-instrumentations-node, nextcloud-server, foxx-cli, kibana, gitlab-rails-ce-fips, lerna,...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: renovate, redisinsight, unleash, rancher-api-ui, dotstatsuite-supercore, verdaccio, actions-runner, sqlpad, tensorflow-gpu-jupyter, langfuse-fips, graalvm, opentelemetry-auto-instrumentations-node, nextcloud-server, foxx-cli, kibana, gitlab-rails-ce-fips, lerna,...

CentOS Linux 8 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1781101271)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1781101271 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled,...

airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-87819 via gitpython (2.1.15)

gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...

CVE-2026-100265

In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...

EUVD-2026-90009

In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...

CVE-2026-100265

JetBrains Rider versions prior to 2026.2.1 are affected by a vulnerability where the AI Assistant could automatically update third-party skills without requiring explicit user confirmation. The provided documents do not specify the underlying root cause, the specific impact beyond unauthorized up...

CVE-2026-100265

In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...

CVE-2026-100265: Download of Code Without Integrity Check

In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782146244)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782146244 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may...

AlmaLinux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc (ALMALINUX9.6:CLSA-2026:1781513275)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781513275 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may...

Rocky Linux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc (ALMALINUX9.6:CLSA-2026:1781513275)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781513275 advisory. - A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto- enrollment is enabled, Samba may...

PT-2026-103312

🚨 CVE-2026-100265 In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation 🎖@cveNotify...

CVE-2026-102424

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...