TencentOS Server 3: kernel (TSSA-2026:0796)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0796 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 2: kernel (TSSA-2026:0797)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0797 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

EulerOS 2.0 SP13 : unbound (EulerOS-SA-2026-3004)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to...

PT-2026-68442

Name of the Vulnerable Software and Affected Versions Carbon console affected versions not specified Description The Ajax processor fails to protect state-changing operations from Cross-Site Request Forgery CSRF, a type of attack that tricks an authenticated user into executing unintended actions...

PT-2026-68821

Name of the Vulnerable Software and Affected Versions udisks2 affected versions not specified Description Insufficient authorization checking in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method allows a local attacker with an active console session to spoof the as-user parameter. This...

EulerOS 2.0 SP15 : unbound (EulerOS-SA-2026-2913)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met...

TencentOS Server 4: kernel (TSSA-2026:0792)

"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0792 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilitie...

Linux Distros Unpatched Vulnerability : CVE-2026-7867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the...

EulerOS 2.0 SP13 : perl-HTTP-Tiny (EulerOS-SA-2026-2986)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated input...

Debian dsa-6414 : gir1.2-udisks-2.0 - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6414 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6414-1 [email protected] https://www.debian.org/security/ Albert...

EulerOS 2.0 SP15 : perl-HTTP-Tiny (EulerOS-SA-2026-2940)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.x000D x000D The...

EulerOS 2.0 SP15 : unbound (EulerOS-SA-2026-2954)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met...

Exploit for Interpretation Conflict in Wordpress

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Ba...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-23001 – Hugging Face Transformers Model Deserializati...

GHSA-FQJ9-69PF-6PJG rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Summary rclone serve restic --private-repos exists to let one rclone instance host many users' restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of //. The documentation states the flag "can be used to limit users to repositories starting with a...

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Summary rclone serve restic --private-repos exists to let one rclone instance host many users' restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of //. The documentation states the flag "can be used to limit users to repositories starting with a...

GHSA-H4MF-4V27-HGGJ rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

Summary WebDAV's default redirect handling can replay Basic authorization and configured Cookie headers over plaintext HTTP after a same-host HTTPS-to-HTTP redirect. This was reproduced through the real backend. Unlike the low-impact STS token in rclone's published S3 redirect advisory, Basic...

Exploit for CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Lea...

CVE-2026-70435

A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...