AlmaLinux 10 : libxml2 (ALSA-2026:39304)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39304 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from th...

Oracle Linux 9 : PackageKit (ELSA-2026-19354)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19354 advisory. 1.2.6-2.0.1 - remove RHEL vendor patch PackageKit-0.3.8-RHEL-Vendor.conf.patch Tenable has extracted the preceding description block directly from the Oracle...

Oracle Linux 10 : systemd (ELSA-2026-19068)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19068 advisory. 257-23.0.1.el102.1 - Fix detection of Oracle Virtualization or BM envs Orabug: 37531877 - Avoid udevadm warnings when using udev valid configs Orabug: 3750319...

Security update for python-soupsieve (important)

openSUSE security update: security update for python-soupsieve ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21342-1 Rating: important References: bsc1271187 bsc1271188 Cross-References: CVE-2026-49476 CVE-2026-49477 CVSS scores: CVE-2026-49476 SU...

Security update for nasm (low)

openSUSE security update: security update for nasm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21333-1 Rating: low References: bsc1261985 bsc1261986 Cross-References: CVE-2026-6067 CVE-2026-6068 CVSS scores: CVE-2026-6067 SUSE : 3.3...

Security update for helm (low)

openSUSE security update: security update for helm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21331-1 Rating: low References: bsc1270127 Cross-References: CVE-2026-48978 CVSS scores: CVE-2026-48978 SUSE : 3.1...

PT-2026-60309

Name of the Vulnerable Software and Affected Versions GPT Researcher version 3.3.7 Description An issue allows attackers to execute arbitrary commands on a victim system through command injection. This occurs when a user interacts with a specially crafted HTML page, and no authentication is...

CVE-2026-30623

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...

PT-2026-60390

Summary @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default :3080 / 0.0.0.0:3080 instead of localhost-only, and its document-management API endpoints do not require...

PT-2026-60311

Name of the Vulnerable Software and Affected Versions xszyou Fay version 4.3.1 Description Remote code execution is possible via the MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface to configure an MCP STDIO...

RHEL 9 : libxml2 (RHSA-2026:39317)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39317 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

AlmaLinux 10 : python3.12 (ALSA-2026:39183)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39183 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

SUSE SLES12: farstream-data / farstream-devel / finch / finch-devel / etc (SUSE-SU-2026:2967-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2967-1 advisory. This update for libgnt, meson, pidgin fixes the following issues Security issue: - CVE-2019-25544: denial of service vulnerability that allows local...

RockyLinux 10 : python3.12 (RLSA-2026:39183)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39183 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

Oracle Linux 10 : vim (ELSA-2026-19073)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19073 advisory. - RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob function - RHEL-155410 CVE-2026-28421 vim: Vim: Denial of servic...

Splunk Enterprise 9.4.0 < 9.4.13, 10.0.0 < 10.0.8, 10.2.0 < 10.2.5, 10.4.0 < 10.4.1 (SVD-2026-0704)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0704 advisory. - In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0,...

RockyLinux 9 : libxml2 (RLSA-2026:39317)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39317 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from th...

PT-2026-60326

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pull request.title into a run: shell command during the pull request opened, reopened, and ready for review event...

CVE-2026-30618

CVE-2026-30618 affects xszyou Fay 4.3.1, where the MCP STDIO server management and command execution handling can be abused via a publicly exposed MCP management interface to execute arbitrary commands in the Fay service context. Technical details across sources describe an RCE via attacker-contr...

PT-2026-60262

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...