Oracle Linux 8 : container-tools:ol8 (ELSA-2026-38504)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38504 advisory. - bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39829, CVE-2026-39830, CVE-2026-39832 cockpit-podman - rebuild for CVE-2025-68121 - update to th...

Oracle Linux 8 : kernel (ELSA-2026-39179)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-39179 advisory. - xfrm: defensively unhash xfrmstate lists in xfrmstatedelete Sabrina Dubroca RHEL-180170 CVE-2026-46116 Tenable has extracted the preceding descripti...

Security update for cyrus-imapd (moderate)

openSUSE security update: security update for cyrus-imapd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21368-1 Rating: moderate References: bsc1271617 bsc1271618 bsc1271619 bsc1271620 bsc1271621 bsc1271622 bsc1271623 bsc1271624 bsc1271625...

CVE-2026-50274

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or...

CVE-2026-9585

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...

CVE-2026-9587

CVE-2026-9587 describes an authenticated local file inclusion in Sangoma Switchvox SMB Edition 8.3 (104997). The issue resides in the play_file function where the sound_path input is not properly validated, allowing an attacker to supply absolute paths to read files outside the intended directory...

EUVD-2026-45203

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...

CVE-2026-60024

Joomla Extension - joomdonation.com - Insecure default configuration Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets...

CVE-2026-60024

The CVE-2026-60024 entry concerns the Joomla extension Events Booking prior to version 5.8.0, where a default insecure configuration allowed unauthenticated users to upload media assets. Attack context is not further detailed in the supplied documents, but CVSS 3.1 reflects a high impact on confi...

CVE-2026-58149 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...

CVE-2026-58149

The CVE describes a vulnerability in the Joomla extension Events Booking (versions before 5.8.0) that allows unauthenticated user enumeration to retrieve account usernames and email addresses. Based on the sources, the issue is an unauthenticated access flaw exposing user data (confidentiality im...

CVE-2026-60025

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

OPENSUSE-SU-2026:21368-1 Security update for cyrus-imapd

This update for cyrus-imapd fixes the following issues: Changes in cyrus-imapd: - Update to 3.8.7 bugfix release - CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack bsc1271617 - CVE-2026-47083: ESEARCH cross-user content oracle bsc1271619 - CVE-2026-47082: Vacation "fcc"...

EUVD-2026-45190

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

RHSA-2026:40841 Red Hat Security Advisory: maven:3.8 security update

Bulletin has no description...

hplip security update

An update is available for hplip. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Proje...

CVE-2026-52348

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...

PT-2026-60810

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

PT-2026-60774

Incorrect access control in Proxmox Virtual Environment PVE 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API...