Fedora 45 : sssd (2026-8fad0036a5)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8fad0036a5 advisory. Automatic update for sssd-2.13.1-3.fc45. Changelog Wed Jul 8 2026 Sumit Bose - 2.13.1-3 - CVE fixes: CVE-2026-12610 CVE-2026-14474 CVE-2026-14476 -...

Fedora 44 : php (2026-ec9cb4652f)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ec9cb4652f advisory. PHP version 8.5.8 02 Jul 2026 Core: Fixed bug GH-22280 Incorrect compile error for goto to label preceding try/finally block. Pratik Bhujel Fixed bug GH-2211...

CVE-2026-33801 Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon RPD of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker sending a specific BGP update over an established BGP session to cause a Denial-of-Service DoS...

MINI-MPQ5-P64G-F7WV

Bulletin has no description...

SUSE-SU-2026:2835-1 Security update for clamav

This update for clamav fixes the following issues - CVE-2026-20213: PE file format parser could allow an unauthenticated, remote attacker to cause a denial of service bsc1270107. - CVE-2026-20214: FSG file format parser could allow an unauthenticated, remote attacker to cause a denial of service...

CVE-2026-49276 Kirby: Self cross-site scripting (self-XSS) in the writer field

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and...

CVE-2026-54002 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize, Sane::sanitize, Sane::Html::sanitize, Sane::Svg::sanitize, Sane::Xml::sanitize, Sane::sanitizeFile, or file sanitizeContents with untruste...

CVE-2026-61343

LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0...

CVE-2026-61343

CVE-2026-61343 — LibreBooking : The email template editor’s save action passes the submitted template name directly into the destination file path. This allows an administrator-authenticated attacker to write arbitrary files outside the template directory and execute code. This vulnerability affe...

CVE-2026-61343 LibreBooking path traversal

LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0...

EUVD-2026-42632

A security flaw has been discovered in Open5GS 2.7.7. This affects the function amfcontextfinal of the file src/amf/context.c of the component AMF. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit has been released to the public and m...

PYSEC-2026-2889 Plone Privilege Escallation

plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level...

`CHECK`-failures in Tensorflow

Impact The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar:pythonimport tensorflow as tfimport numpy as nptf.rawops.MapStage key = tf.constantvalue=4, shape= 1,2, dtype=tf.int64, indices = np.array6, values = np.array-60, dtypes = tf.int64, capacity=0,...

PYSEC-2026-2879 Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

PYSEC-2026-2887 SSRF attacks via tracebacks in Plone

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

PYSEC-2026-2885 Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

SSRF attacks via tracebacks in Plone

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

PYSEC-2026-2886 Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

Malicious code in chai-as-disarmed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d396201a3dd1706d97f7daa880f254c920bbea65ea6b013ed48f78a21a0241 Package name typosquats chai-as-promised while the README and keywords impersonate pino to bait installs. On require, index.js detach-spawns...

USN-8524-1 python2.7, python3.5 vulnerability

It was discovered that Python did not use sufficient entropy for Expat hash-flooding protection in the xml.parsers.expat and xml.etree.ElementTree modules. An attacker could use this to cause a denial of service via a crafted XML document...