RHEL 8 : tigervnc (RHSA-2026:46460)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46460 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine...

Security Advisory 0144

Security Advisory 0144 . CSAF PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release 1.1 | August 3, 2026 | Updated Affected Platforms to include: VeloCloud Orchestrator Hosted 1.2 | August 10, 2026 | Added CSAF JSON file for download The CVE-ID tracki...

RHEL 9 : tigervnc (RHSA-2026:46377)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46377 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine...

RHEL 8 : evince (RHSA-2026:46467)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:46467 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

RHEL 8 : freerdp (RHSA-2026:46389)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:46389 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

RHEL 9 : freerdp (RHSA-2026:46383)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:46383 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

MulRobBench: A Decision-Level Benchmark for Safe and Security-Policy-Compliant Multimodal UAV Agents

Smart-city airspace is transforming Uncrewed Aerial Vehicles UAVs from passive sensing platforms into cyber-physical decision makers that must follow operational rules under degraded observations and ambiguous language. Existing UAV and multimodal benchmarks evaluate perception, navigation,...

Fedora 44 : trafficserver (2026-bb8dc1e5b6)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bb8dc1e5b6 advisory. Resolves CVE-2026-59173 - DoS vulnerability in HTTP/2 via stalled flow-control Additional Changes with Apache Traffic Server 9.2.14 12910 - Fix...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-evidently, crossplane-provider-aws-oam, crossplane-provider-aws-dataexchange, crossplane-provider-aws-dsql, crossplane-provider-aws-servicecatalog, crossplane-provider-aws-mediapackage, crossplane-provider-aws-backup-fips,...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-evidently, crossplane-provider-aws-oam, crossplane-provider-aws-dataexchange, crossplane-provider-aws-dsql, crossplane-provider-aws-servicecatalog, crossplane-provider-aws-mediapackage, crossplane-provider-aws-backup-fips,...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: debezium-connector-spanner, debezium-connector-vitess, debezium-connector-db2, wildfly, kafka, debezium-connector-informix, akhq, debezium, apache-nifi, apache-pulsar, opensearch, apicurio-registry, debezium-connector-ibmi, druid, thingsboard, cassandra-reaper, zipki...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: debezium-connector-spanner, debezium-connector-vitess, debezium-connector-db2, wildfly, kafka, debezium-connector-informix, akhq, debezium, apache-nifi, apache-pulsar, opensearch, apicurio-registry, debezium-connector-ibmi, druid, thingsboard, cassandra-reaper, zipki...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: kubescape-operator, hubble, cloud-provider-vsphere, openbao, flux-notification-controller, argocd-image-updater, kubescape, cloud-provider-gcp-cloud-controller-manager, cluster-api-azure-controller, node-feature-discovery, cluster-api, zot, cluster-api-helm-controlle...

Malicious code in wsh4_edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...

MAL-2026-11072 Malicious code in wsh4_edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: pinot, logstash, cassandra-reaper, apache-pulsar, confluent-kafka-jre-bcfips, akhq, sonarqube, spark-kubernetes-operator, pinot-fips, elasticsearch-fips, seata, conductor-fips, kafbat-ui, thingsboard, apicurio-registry-fips, wazuh-indexer, apache-hop, spark-fips,...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: pinot, logstash, cassandra-reaper, apache-pulsar, confluent-kafka-jre-bcfips, akhq, sonarqube, spark-kubernetes-operator, pinot-fips, elasticsearch-fips, seata, conductor-fips, kafbat-ui, thingsboard, apicurio-registry-fips, wazuh-indexer, apache-hop, spark-fips,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: cluster-api-provider-vsphere, chainloop-cli-fips, seaweedfs-operator-fips, rancher-agent, cloud-provider-azure, kubeflow-pipelines, keda-http-add-on, crossplane, cloud-provider-azure-fips, elastic-agent-fips, kapp-controller, omni-fips, yunikorn-k8shim-fips,...

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it...

DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts

The operators of the DevMan ransomware-as-a-service RaaS scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administere...