PT-2026-84392

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

PT-2026-84388

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

PT-2026-84521

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...

PT-2026-84543

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig data when re-encoding a message with a misplaced TSIG record. sig data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or...

PT-2026-84292

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions prior to 5.8.1.11 Description An authentication bypass exists in the JWT Refresh Token Handler component. A remote attacker can perform a manipulation of the Bearer argument within the '/api/connections' endpoint, leading...

Alibaba Cloud Linux 3 : 0263: python-idna (ALINUX3-SA-2026:0263)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0263 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-45409: Internationalized Domain Names in...

RHEL 8 : kernel (RHSA-2026:61973)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61973 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bridge: stop fast-leave after...

PostgreSQL 14.x < 14.24 / 15.x < 15.19 / 16.x < 16.15 / 17.x < 17.11 / 18.x < 18.6 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 14 prior to 14.24, 15 prior to 15.19, 16 prior to 16.15, 17 prior to 17.11, or 18 prior to 18.6. As such, it is potentially affected by multiple vulnerabilities: - Type confusion with PostgreSQL 'internal' data type arguments allows any us...

Linux Distros Unpatched Vulnerability : CVE-2026-84127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155. CVE-2026-84127 Note that Nessus relie...

RHEL 8 : kernel (RHSA-2026:61932)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61932 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv6: fix possible UAF in...

AlmaLinux 8 : glib2 (ALSA-2026:61766)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61766 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd via...

MiracleLinux 8 : go-toolset:rhel8 delve-1.26.1-1.module+el8+2035+c232904f.ML.1, golang-1.26.7-1.module+el8+2035+c232904f.ML.1 (AXSA:2026-1726:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1726:01 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...

openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21696-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: -...

RHEL 8 : kernel (RHSA-2026:61959)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61959 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: free...

PT-2026-84384

Improper Handling of Highly Compressed Data CWE-409 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing,...

SPIP 4.4.8 Insecure Deserialization

SPIP versions 4.4.0 through 4.4.8 contain an insecure deserialization vulnerability in the public area through the tablevaleur filter and DATA iterator. An attacker able to place malicious serialized content can trigger arbitrary object instantiation and potentially achieve remote code execution...

xorg-x11-server security update

1.20.11-28.3 - CVE fix for CVE-2026-55999 Resolves: https://redhat.atlassian.net/browse/RHEL-191504...

mingw-sqlite security update

3.26.0.0-3 - Fix CVE-2026-11822 CVE-2026-11824 Resolves: RHEL-218233...

KLA91249 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Security...

Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer...