RHEL 8 : firefox (RHSA-2026:64814)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:64814 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

RHEL 10 : thunderbird (RHSA-2026:65159)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65159 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the Graphics:...

RHEL 10 : thunderbird (RHSA-2026:65633)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65633 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the Graphics:...

RHEL 9 : thunderbird (RHSA-2026:65670)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65670 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the Graphics:...

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-3270)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : dlm: validate length in dlmsearchrsbtreeCVE-2026-43125 net: annotate data-races around sk-skdataready,writespaceCVE-2026-23302 netfilter: ctnetlin...

CVE-2026-82755

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

EUVD-2026-72537

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

BrowserBox v18.8.0

BrowserBox by DOSAYGO Secure, modern Remote Browser Isolation RBI with a clientless experience Read the BrowserBox docs → ⚡ NEW in v20.0.0 — BrowserBox, rewritten in Freelang Eight years. Twenty versions. One mission. BrowserBox's production runtime has been rewritten in Freelang and compiled to ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053421)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053421 advisory. In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Don't offline the last non-isolated CPU If a system has isolated CPUs via the...

SUSE CVE-2026-53471

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens JWTs for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the sourceid claim within these tokens against the requested source ID. This oversight allows an...

SUSE CVE-2026-71325

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a...

SUSE CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85152

undici (the Node.js HTTP client) versions 8.10.0 through 8.10.2 are vulnerable to cross-origin cache poisoning when the cache or deduplicate interceptor is composed directly onto a Client or Pool. The root cause is that the internal cache key falls back to an empty origin string, so a cacheable o...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-19274

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 contains a vulnerability in the Instana Agent Operator where cluster-scoped RBAC objects are keyed solely by the bare Custom Resource name with no namespace disambiguation. An authenticated Kubernetes tenant can exploit this by ...

EUVD-2026-71273

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19274 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...