137127 matches found
CVE-2026-65637: Improper Input Validation
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...
PT-2026-81123
Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /evil.com whose second character is a...
PT-2026-81363
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in SystemTwigSecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models...
PT-2026-81375
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp process server msg the code calls atoistrtok ruid, "-", &tmp without checking the strtok r return value. When the server-supplied uid is empty or contains...
mod_http2 security, bug fix, and enhancement update
2.0.26-6.2 - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in modhttp2...
nodejs24 security update
1:24.18.0-5.0.1 - Add c-ares as dependency orabug 39781256 - Update upstream references 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - Fix CVE-2026-13149 brace-expansion...
Oracle Linux 9 : python3.12 (ELSA-2026-59009)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-59009 advisory. 3.12.14-1.0.1 - Remove upstream URL reference 3.12.14-1 - Update to Python 3.12.14 Resolves: RHEL-227215 3.12.13-3.1 - Security fix for CVE-2026-15308 Resolves...
Oracle Linux 7 : libreoffice (ELSA-2026-46386)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-46386 advisory. - Backport fix for CVE-2026-4430 Orabug: 39791243 - Backport fix for CVE-2026-8357 Orabug: 39791243 Tenable has extracted the preceding description...
Important: Red Hat Security Advisory: RHACS 4.10.7 security and bug fix update
Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...
Important: Red Hat Security Advisory: RHACS 4.9.11 security and bug fix update
Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...
CLSA-2026-1787602147 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.5-tuxcare.1...
CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...
CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...
CLSA-2026-1787592261 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.5...
CLSA-2026-1787592062 TuxCare security update for node-notifier (1 CVE)
TuxCare rebuilt node-notifier to address 1 CVE. Fixed in 7.0.2-tuxcare.1...
CLSA-2026-1787592038 TuxCare security update for js-yaml (1 CVE)
TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.15.0-tuxcare.1...
CVE-2026-19685
NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...
ROOT-OS-DEBIAN-13-CVE-2026-59997 CVE-2026-59997 in openssh - Patched by Root
Root has patched CVE-2026-59997 in the openssh package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2026-60002 CVE-2026-60002 in openssh - Patched by Root
Root has patched CVE-2026-60002 in the openssh package for Root:Debian:13. Multiple fixed versions available...
CVE-2026-63621 Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...