EUVD-2026-72588

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76977

SAP UI5 is affected by a clickjacking vulnerability in its Frame Options Allowlist mechanism. The framework does not sufficiently validate the parent frame's origin against the configured allowlist, allowing an unauthenticated attacker to host a malicious page that bypasses framing restrictions. ...

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76960

SAP S/4HANA Finance (Advanced Payment Management) is affected by a Cross-Site Request Forgery (CSRF) vulnerability caused by insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page; when an authenticated victim interacts with it, uninte...

CVE-2026-76977: Improper Validation of Unsafe Equivalence in Input

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

Security update for ucode-intel (important)

openSUSE security update: security update for ucode-intel ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21736-1 Rating: important References: bsc1265189 bsc1274785 Cross-References: CVE-2025-31936 CVE-2025-31938 CVE-2025-35973 CVE-2025-35979...

amazon-ssm-agent-3.3.5226.0-1.1 on GA media (moderate)

amazon-ssm-agent-3.3.5226.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11694-1 Rating: moderate Cross-References: CVE-2025-22869 CVE-2026-25934 CVE-2026-71556 CVSS scores: CVE-2025-22869 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-22869 SUSE : 8.2...

Security update for libidn (moderate)

openSUSE security update: security update for libidn ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21758-1 Rating: moderate References: bsc1268965 Cross-References: CVE-2026-57053 CVSS scores: CVE-2026-57053 SUSE : 4...

Fedora 44 : corosync (2026-e97124c200)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e97124c200 advisory. Fix CVE-2026-81666 and CVE-2026-81665 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

The vulnerability of the __rds_rdma_map() function in the net/rds/rdma.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rdsrdmamap function in the net/rds/rdma.c module of the Linux operating system is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protect...

libmsgpack-c2-7.0.2-2.1 on GA media (moderate)

libmsgpack-c2-7.0.2-2.1 on GA media Announcement ID: openSUSE-SU-2026:11672-1 Rating: moderate Cross-References: CVE-2026-72854 CVSS scores: CVE-2026-72854 SUSE : 5.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can no...

The vulnerability of the unix_stream_bpf_update_proto() function in the net/unix/unix_bpf.c module, which implements networking functions in the Linux operating system’s kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the unixstreambpfupdateproto function in the net/unix/unixbpf.c module, which implements networking functions in the Linux operating system’s kernel, is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an...

Fedora 43 : python-pip (2026-30b4eb25df)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-30b4eb25df advisory. Security fixes for CVE-2026-13346 and CVE-2026-8643 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Oracle Linux 10 : ELSA-2026-62578-0: / go-fdo-server (ELSA-2026-625780)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-625780 advisory. 1.0.1-4 - Rebuild go-fdo-server against updated golang 1.0.1-3 - Rebuild against updated golang Tenable has extracted the preceding description bloc...

Fedora 43 : mingw-openexr (2026-bcc9ac580d)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bcc9ac580d advisory. Update to openexr 3.4.15 resp 3.3.14. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Injection fast-uri Dependency in Jira Service Management Data Center

This High severity Injection vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2026-83616

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. An attacker can exploit a vulnerability in how processing instructions are handled to inject arbitrary XML structures. This occurs because the software fails to properly validate input, allowing special characters to...

dovecot24-2.4.5-1.1 on GA media (moderate)

dovecot24-2.4.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11629-1 Rating: moderate Cross-References: CVE-2026-27852 CVE-2026-33263 CVE-2026-33604 CVE-2026-33605 CVE-2026-33606 CVE-2026-33607 CVE-2026-40014 CVE-2026-40015 CVE-2026-40017 CVE-2026-40019 CVE-2026-40203 CVE-2026-40205...

The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data and influence the integrity of the data.

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the lack of protective measures for the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a special...