137089 matches found
PT-2026-85258
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...
PT-2026-89118
Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description A crafted image item containing a clap property and an ispe width or height greater than INT32 MAX + 1 can reach crop calculations through the heif image handle get image tiling function. The...
Linux Distros Unpatched Vulnerability : CVE-2026-65109
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix...
Linux Distros Unpatched Vulnerability : CVE-2026-65139
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix various issues in unsafe operation/queries to the slurmdbd CVE-2026-65139 Note that Nessus relies on the...
nodejs:24 security update
nodejs 1:24.18.0-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 5.9.0 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223388 RHEL-223907 RHEL-223792 1:24.18.0-3 - Backport patch update sqlite to 3.53.4 Fixes: CVE-2026-11824, CVE-2026-11822...
Linux Distros Unpatched Vulnerability : CVE-2026-80229
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When performing transfers via libcurl's multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations...
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...
GHSA-MC5Q-6HPJ-RP7J Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 vulnerability discovered by ? in WordPress Npm link-preview-js versions = 4.0.3...
GHSA-CPJF-6666-R8FX link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...
CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-76098 affecting package python-mistune for versions less than 3.3.4-1
CVE-2026-76098 affecting package python-mistune for versions less than 3.3.4-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CLSA-2026-1788376116 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.4...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.0-0.1.4.hum1 aarch64, x8664 grafana13.2-13.2.0-0.1.4.hum1.src src Security Fixes: grafana13.2: CVE-2026-84375...
GO-2026-6306 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 in code.vikunja.io/api
Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parentprojectid=0 in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.9-0.5.hum1 aarch64, x8664 grafana12.4-12.4.9-0.5.hum1.src src Security Fixes: grafana12.4: CVE-2026-84375...