Linux Distros Unpatched Vulnerability : CVE-2026-13608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic...

Linux Distros Unpatched Vulnerability : CVE-2026-84134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84352

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-18771

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16...

CVE-2026-18771 Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16...

PT-2026-84458

Name of the Vulnerable Software and Affected Versions GeoNetwork versions prior to 4.4.12 GeoNetwork versions prior to 4.2.17 Description The Saxon XSLT processor used to render formatters is configured without secure processing FEATURE SECURE PROCESSING and without disabling Java extension...

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More

The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.9-0.4.hum1 aarch64, x8664 grafana12.4-12.4.9-0.4.hum1.src src Security Fixes: grafana12.4: CVE-2026-73501 CVE-2026-75899 CVE-2026-75931 CVE-2026-75975 CVE-2026-76172...

Exploit for CVE-2026-81578

PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit A...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

PAN-OS Management Interface - Path Confusion to Authentication Bypass

A vulnerability in PAN-OS management interface allows authentication bypass through path confusion between Nginx and Apache handlers.The issue occurs due to differences in path processing between Nginx and Apache, where double URL encoding combined with directory traversal can bypass authenticati...

FLIR AX8 1.46.16 - Remote Command Injection

FLIR AX8 version 1.46.16 and below is susceptible to an unauthenticated remote command injection vulnerability.The vulnerability exists in the alarm functionality where user-supplied input in the 'id' parameter is not properly sanitized,allowing attackers to inject and execute arbitrary OS...

Linux Distros Unpatched Vulnerability : CVE-2025-70291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - u-boot - None Ubuntu Linux - Unknown description CVE-2025-70291 Note that Nessus relies on the presence of the package as reported by the vendor...

CVE-2026-16723

Exploit CVE-2026-16723 Un'implementazione autonoma in C++17 per CVE-2026-16723 , una vulnerabilità critica che colpisce le versioni 1.2.68 – 1.2.83 di Fastjson. Requisiti Linux o WSL su Windows Compilatore compatibile con C++17 GCC 7+ o Clang 5+ CMake 3.10 o successivo Pacchetti di sistema:...

CVE-2026-56854

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...

Critical: Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.4.4 provides these changes:...

EUVD-2026-66589

In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will...

SysAid Server - Remote Code Execution

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. id: CVE-2023-47246 info: name: SysAid Server - Remote Code Execution author: iamnoooob,rootxharsh,pdresearc...

D-Link Network Attached Storage - Backdoor Account

A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user...

CVE-2026-47837

Spring Cloud Config Server is vulnerable to Missing Authentication for Critical Function via its /monitor endpoint, which does not validate incoming webhook requests. An attacker can trigger unauthorized actions or cause unintended effects by sending crafted webhook requests to this endpoint. Aff...