CVE-2026-79759

The web-based server management platform Termix (versions 1.7.0 through 2.5.1) is vulnerable to cross-user information disclosure due to a missing ownership check in the POST /credentials/:id/deploy-to-host endpoint. Located in src/backend/database/routes/credentials.ts, the application fails to ...

EUVD-2026-86157

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...

Important: Red Hat Security Advisory: host-metering security update

An update for host-metering is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.1.0 Vulnerability Details CVEID:CVE-2026-12537 DESCRIPTION: Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1 and run-gemini-cli GitHub Action versions prior to 0.1.2...

CVE-2026-77703

The HAVELSAN Inc. Liman Render Engine (versions 1.0 before 1.2-75 ) is vulnerable to an SSH Host Key Verification Bypass due to a key exchange without entity authentication. This flaw enables an Adversary in the Middle (AiTM) attack. The vulnerability has a CVSS 3.1 base score of 5.9 (Medium) , i...

CVE-2026-77703 SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...

CVE-2026-77703 SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine

Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...

Malicious code in eslint-config-compact-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b index.js executes on module load and collects host reconnaissance data — os.platform, os.hostname, os.userInfo.username, architecture, Node version,...

Guest can panic host through filesystem datetime overflow

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory...

podman: Arbitrary file write when importing OCI archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

Updated perl-URI packages fix a security vulnerability

Apply Unicode NFC normalization in URI::idna nameprep so IDNA host encoding matches other clients instead of emitting a non-standard, non-round-tripping A-label CVE-2026-19953...

MGASA-2026-0445 Updated perl-URI packages fix a security vulnerability

Apply Unicode NFC normalization in URI::idna nameprep so IDNA host encoding matches other clients instead of emitting a non-standard, non-round-tripping A-label CVE-2026-19953...

Oracle Linux 7 : host-metering (ELSA-2026-53416)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-53416 advisory. - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-27145 Orabug: 39863765 Tenable has extracted the preceding description block directly from the...

PT-2026-97918

Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. The POST '/credentials/:id/deploy-to-host' endpoint fails to verify if the records associated...

PHP 8.2.x < 8.2.34 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.2.34. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.34 advisory. - Debian Linux - php8.2 - None php8.4 - None CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766,...

Linux Distros Unpatched Vulnerability : CVE-2026-97492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: don't call ieee80211handlereconfigfailure when not needed In case reconfiguration of NAN fails, we call ieee80211handlereconfigfailure, that mar...

RHEL 7 : host-metering (RHSA-2026:71619)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71619 advisory. Host metering service Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860...

Linux Distros Unpatched Vulnerability : CVE-2026-93804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: ibss: wait for in-flight TX on disconnect While leaving an IBSS in ieee80211ibssdisconnect mac80211 flushes stations, turns the carrier off and...

Linux Distros Unpatched Vulnerability : CVE-2026-97410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netconsole: take targetcleanuplistlock in dropnetconsoletarget dropnetconsoletarget unlinks the target while only holding targetlistlock. However, when the...

CVE-2026-97508: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return error to the remote host. However, we need to make sure we keep the uui...