CLSA-2026-1776763910 libsoup: Fix of 2 CVEs

CVE-2026-1467: validate URI host characters when checking if a URI is valid - CVE-2026-1539: fix proxy credentials leak on cross-origin HTTP redirect...

CLSA-2026-1776763201 libsoup: Fix of 2 CVEs

CVE-2026-1467: validate URI host characters when checking if a URI is valid - CVE-2026-1539: fix proxy credentials leak on cross-origin HTTP redirect...

python: Python: HTTP header injection via CR/LF in proxy tunnel headers

A flaw was found in Python. This vulnerability allows for the injection of extra information into HTTP communication. Specifically, the system does not properly prevent special characters carriage return and line feed from being included in HTTP client proxy tunnel headers or host fields...

SUSE-SU-2026:1511-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options bsc1261769. - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation bsc1261770...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options bsc1261769. CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation bsc1261770. Patch Instructions: To install this SUSE upda...

CVE-2026-41303

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending hos...

CVE-2026-41330

OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification,...

PT-2026-34172

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010933)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010933 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: alcor: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore its...

CIQ Extended Support

A CIQ package update service provides extended support and/or OS hardening for the remote host. %NASLMINLEVEL 80900 C Tenable Network Security, Inc. include"compat.inc"; if description scriptid307904; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/04/21";...

Mozilla Thunderbird < 150.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 150.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-33 advisory. - Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerabili...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-007003)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007003 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 scsi: core: Remove...

Mozilla Thunderbird < 150.0

The version of Thunderbird installed on the remote Windows host is prior to 150.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-33 advisory. - Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fix...

RHEL 9 : git-lfs (RHSA-2026:9434)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:9434 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing th...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-010798)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010798 advisory. In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy run-time warning in dgdispatchashost Syzkaller hit 'WARNING in dgdispatchashost...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010807)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010807 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: meson-gx: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore its...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010786)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010786 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore it...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011179)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011179 advisory. In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: fix return value check of mmcaddhost mmcaddhost may return error, if we ignore it...

Photon OS 5.0: Jq PHSA-2026-5.0-0827

An update of the jq package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0827. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid307869...

PT-2026-34195

Name of the Vulnerable Software and Affected Versions Hermes WebUI affected versions not specified Description An arbitrary file deletion issue exists in the '/api/session/delete' endpoint. Authenticated attackers can delete files outside the session directory by providing an absolute path or pat...