Kibana 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 DoS (ESA-2026-163)

The version of Kibana installed on the remote host is 8.x prior to 8.19.16, or 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-163 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:65117)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:65117 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

RockyLinux 9 : osbuild-composer (RLSA-2026:65153)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65153 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Oracle Linux 8 : ELSA-2026-65160-0: / thunderbird (ELSA-2026-651600)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-651600 advisory. 140.14.0-1.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.14.0 - Add OpenELA debranding 140.14.0-1 - Update to 140.14.0 ESR...

RockyLinux 8 : expat (RLSA-2026:64809)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64809 advisory. expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via...

Oracle Linux 9 : ELSA-2026-64800-0: / glib2 (ELSA-2026-648000)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-648000 advisory. 2.68.4-19.10 - Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c Tenable has extracted the preceding description block directly from the Oracle Linux...

RHEL 8 : glib2 (RHSA-2026:65771)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65771 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 10 : osbuild-composer (RHSA-2026:65895)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65895 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

openSUSE 16 Security Update : cpio (openSUSE-SU-2026:21747-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21747-1 advisory. - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended...

Kibana 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Incorrect Authorization (ESA-2026-156)

The version of Kibana installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-156 advisory. - Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead...

RockyLinux 8 : thunderbird (RLSA-2026:65160)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65160 advisory. firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74934 firefox: thunderbird: Privilege escalation in the...

Kibana 7.x / 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Path Traversal (ESA-2026-160)

The version of Kibana installed on the remote host is 7.11.0 through 7.17.29, or 8.x prior to 8.19.16, or 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-160 advisory. - Improper Limitation of a Pathname to a Restricted...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps

Summary Multiple vulnerabilities were addressed in IBM Aspera Enterprise Webapps version 1.0.6 Vulnerability Details CVEID:CVE-2026-54500 DESCRIPTION: Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads...

CVE-2026-86079

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

Aegis aegis-v0.14.1-alpha

AEGIS Independent, OS-level observability for AI coding agents Watches what AI agents actually do on your machine — processes, files, network — from outside the agents, no hooks required. AEGIS is an independent, OS-level observer for AI agents. It watches agent processes, file access, and networ...

CVE-2026-83950

creationtimestamp| type| source ---|---|--- 2026-09-08 22:09:29+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:08:34+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review...

CVE-2026-83950

This CVE entry is reserved , indicating technical details have not yet been publicized. The only reference is a ZDI blog post on the September 2026 security update review. Monitor for updates as the disclosing organization publishes specifics.

CVE-2026-78455

creationtimestamp| type| source ---|---|--- 2026-09-08 22:09:19+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:08:15+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 10:50:01+00:00|...

CVE-2026-69839

creationtimestamp| type| source ---|---|--- 2026-09-08 22:09:18+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:08:13+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:51:25+00:00|...