Fedora 45 : hplip (2026-c5b6bb47c5)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c5b6bb47c5 advisory. Automatic update for hplip-3.26.4-7.fc45. Changelog Fri Jul 3 2026 Zdenek Dohnal - 3.26.4-7 - fix CVE-2026-14544 - incomplete fix after CVE-2026-863...

AlmaLinux 8 : ruby:2.5 (ALSA-2026:33514)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:33514 advisory. ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments CVE-2026-42258 net-imap: ruby: Net::IMAP: Information disclosure via...

Fedora 45 : python-tornado (2026-672e8e4169)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-672e8e4169 advisory. Automatic update for python-tornado-6.5.7-1.fc45. Changelog Mon Jun 22 2026 Peter Robinson - 6.5.7-1 - Update to 6.5.7 - CVE-2026-35536 rhbz2457335,...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-8501-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8501-1 advisory. It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is know...

Fedora 45 : docker-compose (2026-caecf8f2d7)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-caecf8f2d7 advisory. Automatic update for docker-compose-5.3.0-1.fc45. Changelog Thu Jul 2 2026 Bradley G Smith - 5.3.0-1 - Update to release v5.3.0 - Resolves:...

MINI-286C-MX67-5PMC

Bulletin has no description...

CVE-2026-13054

A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem...

CVE-2026-13383

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI...

CVE-2026-50721 IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload

Libreswan, via the function RSAauthenticatehashsignaturerawrsa, did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS 1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to for...

EUVD-2026-37821

Steeltoe: OAEP setting silently selects PKCS1 v1.5 padding...

EUVD-2026-41214

Craft CMS: Authorship spoofing in entries/save-entry via pre-check/post-mutation authorization gap...

CVE-2026-54402

creationtimestamp| type| source ---|---|--- 2026-07-02 18:19:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mponh36wia2z 2026-07-03 07:08:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppyewqvlf2d 2026-07-03 21:36:06+00:00| seen|...

CVE-2026-8699

A stored Cross-Site Scripting XSS vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field. An attacker with administrative privilege...

EUVD-2026-41416

Craft CMS is a content management system CMS. Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function...

K000162053: Node.js vulnerability CVE-2025-55131

Security Advisory Description A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like...

EUVD-2026-41409

Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...

WordPress Struktur Core plugin <= 2.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Struktur Core versions = 2.5.1...

Openstack Manila Persistent XSS in Metadata field

Cross-site scripting XSS vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form...

PYSEC-2026-758 Zope does not properly verify the access for objects with proxy roles

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration...

PYSEC-2026-632 Cross-site scripting vulnerability in TinyMCE plugins

Impact A cross-site scripting XSS vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the...