Alibaba Cloud Linux 3 : 0260: isns-utils (ALINUX3-SA-2026:0260)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0260 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-55995: A Double Free vulnerability in...

Alibaba Cloud Linux 3 : 0265: bind (ALINUX3-SA-2026:0265)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0265 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-10723: BIND may accept incorrect...

Alibaba Cloud Linux 3 : 0261: grafana (ALINUX3-SA-2026:0261)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0261 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-33377: An Editor can overwrite a dashboard...

Alibaba Cloud Linux 3 : 0263: python-idna (ALINUX3-SA-2026:0263)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0263 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-45409: Internationalized Domain Names in...

Alibaba Cloud Linux 3 : 0259: resource-agents security update (Important) (ALINUX3-SA-2026:0259)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0259 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-59886: pyasn1 is a generic ASN.1 library f...

Alibaba Cloud Linux 3 : 0262: abrt (ALINUX3-SA-2026:0262)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0262 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-54228: A time-of-check time-of-us...

CVE-2026-51769

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

PT-2026-84313

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs broker component...

CVE-2026-51769

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is susceptible to an incorrect access control vulnerability in the remoteCloudUpdateCheck function. An unauthenticated attacker can exploit this by sending a crafted MQTT message to the cs_broker component, which allows them to restar...

EUVD-2026-69379

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

Alibaba Cloud Linux 3 : 0270: gstreamer1-plugins-bad-free (ALINUX3-SA-2026:0270)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0270 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-19387: A heap out-of-bounds write...

Alibaba Cloud Linux 3 : 0278: curl (ALINUX3-SA-2026:0278)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0278 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-8286: A vulnerability exists where a new...

Alibaba Cloud Linux 3 : 0276: python3 (ALINUX3-SA-2026:0276)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0276 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-11940: tarfile.extractall with the 'data' ...

CVE-2026-61640 Wallos: SSRF via OIDC Token/UserInfo URL Configuration

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC tokenurl and userinfourl in includes/oidc/handleoidccallback.php:18-49 are used directly in curlinit with zero SSRF filtering. Unlike logo/webhook URLs which have...

CVE-2026-61640

Wallos , an open-source self-hostable personal subscription tracker, is affected by an SSRF vulnerability prior to version 4.9.6. The root cause is in includes/oidc/handle_oidc_callback.php (lines 18–49), where Admin-configured OIDC token_url and user_info_url values are passed directly to curl_i...

CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

[SECURITY] Fedora 44 Update: hcloud-1.67.0-1.fc44

A command-line interface for Hetzner Cloud...

[SECURITY] Fedora 43 Update: hcloud-1.67.0-1.fc43

A command-line interface for Hetzner Cloud...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...