CVE-2026-57833 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature...

USN-8545-1: Linux kernel (HWE) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; -...

USN-8545-1 linux-hwe-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; -...

K000162267: Openfire vulnerability CVE-2023-32315

Security Advisory Description Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the...

SUSE CVE-2026-40468

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below...

SUSE CVE-2026-54736

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first...

SUSE CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

PT-2026-60304

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description The Kiro API-key validation endpoint 'POST /api/oauth/kiro/api-key' builds an upstream URL using a user-controlled region value. An authenticated attacker can provide a crafted region to redirect the...

SUSE SLES12 Security Update : kernel (Live Patch 70 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:2992-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2992-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.266 fixes various security issues The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel (Live Patch 37 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:2938-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2938-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.144 fixes various security issues The following security issues were fixed: ...

Fedora 45 : ruby (2026-7f499e0362)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7f499e0362 advisory. Ruby 4.0.6 is released. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PT-2026-60288

CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak...

PT-2026-60290

CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client...

PT-2026-60252

Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.17 through 4.15.0-beta4 Description An authenticated user can save a workflow node that references another user's private HTTP toolset by providing a crafted tool ID in the format http-/. While standard toolset routes...

PT-2026-60323

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.35 Description The cloneBoard Meteor method in models/import.js fails to invoke the canExport function or verify membership of the source board when using the sourceBoardId variable. This allows an authenticated user...

PT-2026-60287

CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client...

Security update for go1.25-openssl (critical)

openSUSE security update: security update for go1.25-openssl ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21319-1 Rating: critical References: bsc1170826 bsc1244485 bsc1245878 bsc1256818 bsc1257692 bsc1259264 bsc1259265 bsc1259268 bsc1261653...

Security update for go1.25 (important)

openSUSE security update: security update for go1.25 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21324-1 Rating: important References: bsc1244485 bsc1245878 bsc1259264 bsc1259265 bsc1259268 bsc1264394 bsc1271014 bsc1271015 Cross-References:...

JLSEC-2026-701

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 wolfSSL 5.8.2 and earlier is...

JLSEC-2026-750 Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5...

Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5 in certificate processing...