ROS-20260803-73-0034

The vulnerability of the smb component in the Linux operating system’s kernel is related to improper control of resource identifiers. Exploiting this vulnerability could allow an attacker to compromise data integrity...

The vulnerability of the quote() function in the shell-quote npm package, which allows a hacker to execute arbitrary code.

The vulnerability of the quote function in the shell-quote npm package is related to the lack of data cleansing measures at the control level. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

EUVD-2026-52478

An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...

CVE-2026-67970

Incorrect access control in the DSSetDestPathCmd component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal...

CVE-2026-67972

CVE-2026-67972 affects NASA cFS v7.0.1, in the CF_CFDP_RecvMd() component. The issue allows attackers to control where received content and data are stored, which can lead to information disclosure. The available sources specify the affected product and component, and note the potential for discl...

openSUSE 16: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (openSUSE-SU-2026:21508-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21508-1 advisory. - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution bsc1271638. - CVE-2026-39872:...

Linux Distros Unpatched Vulnerability : CVE-2026-12259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing...

Linux Distros Unpatched Vulnerability : CVE-2026-59642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS...

RHEL 7 : libsolv (RHSA-2026:49775)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:49775 advisory. The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fixes: libsolv: Heap buffer...

CVE-2026-67973

CVE-2026-67973 affects NASA cFS v7.0.1 in the CFDP receive path. The issue enables a DoS by replaying final CFDP PDUs, as described in the CVE and corroborated by multiple sources (NVD, EUVD ENISA, CVE Repo). The root cause is tied to the CFDP receive path; no explicit exploit code, products, ver...

Unbreakable Enterprise kernel security update

5.4.17-2136.358.2 - xfs: resample the data fork mapping after cycling ILOCK Darrick J. Wong Orabug: 39776792 CVE-2026-64600 - net: Work around Marvell NIC TX stalls Venkat Venkatsubra Orabug: 39765820 5.4.17-2136.358.1 - KVM: x86: Fix shadow paging use-after-free due to unexpected role Paolo...

The vulnerability of the JIT-compiler of Mozilla Firefox allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the JIT-compiler of Mozilla Firefox lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-65321

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321 PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321 PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-64371

A flaw was found in the Linux kernel's procfs a virtual filesystem that provides information about running processes. This vulnerability occurs because certain functions within procfs do not properly protect access to process memory information. A local attacker could exploit this missing...

CVE-2026-68582

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582

Vikunja up to 2.3.0 contains a broken object level authorization (BOLA) in the task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks. The endpoint loads the requested project view from the URL path without validating the caller’s authorization, allowing a link-share token hol...