CVE-2026-46405

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

Fedora 43 : abrt (2026-cccf5985b5)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cccf5985b5 advisory. Update to 2.17.9 Resolves: 2484614 Resolves: CVE-2026-54230 Resolves: CVE-2026-54231 Resolves: CVE-2026-54228 Resolves: CVE-2026-54229 Tenable has...

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...

CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API

Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification...

CLSA-2026-1783386120 TuxCare security update for symfony/mime (2 CVEs)

TuxCare rebuilt symfony/mime to address 2 CVEs. Fixed in v5.4.45-p1+tuxcare...

CLSA-2026-1772326385 TuxCare security update for illuminate/database (1 CVE)

TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p2+tuxcare...

CLSA-2026-1777249675 TuxCare security update for 2 packages (4 CVEs)

TuxCare rebuilt 2 packages to address 4 CVEs. Fixed in 5.4.14-tuxcare.2...

CLSA-2026-1770682156 TuxCare security update for org.hibernate (1 CVE)

TuxCare rebuilt 8 org.hibernate packages to address 1 CVE. Fixed in 5.4.3.Final-tuxcare.1...

Important: gawk

Issue Overview: Use After Free vulnerability has been found in "io.c" program file of gawk dogetlineredir routine. This issue may lead to a crash. It affects gawk in versions 5.4.0 and below. CVE-2026-40467 Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This...

WordPress WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce plugin <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation vulnerability

Authenticated Shop Manager+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPify Woo Czech versions = 5.4.16...

[R2] Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2

R2 Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2 Jason Schavel Fri, 07/31/2026 - 13:00 Security Center on Tenable Enclave Security leverages third-party software to help provide underlying functionality. Several of the...

WordPress SAML Single Sign On – SSO Login plugin <= 5.4.4 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin SAML SP Single Sign On versions = 5.4.4...

CLEANSTART-2026-NF97709 Security fixes in k8s-sidecar 2.5.4-r0

Package k8s-sidecar version 2.5.4-r0 fixes 2 vulnerabilities: CVE-2026-25645, ghsa-gc5v-m9x4-r6x2...

CLEANSTART-2026-IB96033 Security fixes in py3-jupyterhub 5.4.6-r0

Package py3-jupyterhub version 5.4.6-r0 fixes 4 vulnerabilities: CVE-2026-44307, CVE-2026-42304, ghsa-grgv-6hw6-v9g4, ghsa-2h4p-vjrc-8xpq...

CLEANSTART-2026-ZD86302 Security fixes in neuvector-fips 5.4.8-r0

Package neuvector-fips version 5.4.8-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangChain [CVE-2026-44843]

Summary IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangChain, due to older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists CVE-2026-44843. Langchain is used i...

CVE-2026-59239

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

JLSEC-2026-787 Integer overflow in gawk's `do_sub()` can cause buffer overflow and denial of service

Integer overflow vulnerability has been found in "builtin.c" program file of gawk dosub routine. This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below...

JLSEC-2026-785 Use after free vulnerability in gawk 5.4.0 and earlier

Use After Free vulnerability has been found in "io.c" program file of gawk dogetlineredir routine. This issue may lead to a crash. It affects gawk in versions 5.4.0 and below...

JLSEC-2026-788 Buffer overflow in gawk's `readdir.c` can cause denial of service and possible code execution

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk ftype routine. This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below...