dnsmasq security update

2.90-7 - Prevent overflow in extractname function CVE-2026-2291 - Prevent DoS in DNSSEC validation CVE-2026-4890 - Prevent out-of-bounds read in DNSSEC validation CVE-2026-4891 - Prevent out-of-bounds write in DHCPv6 server CVE-2026-4892 - Prevent source check avoidance by RFC 7871 client-subnet...

RHEL 10 : python3.14 (RHSA-2026:40856)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40856 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Linux Distros Unpatched Vulnerability : CVE-2026-43705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6,...

Linux Distros Unpatched Vulnerability : CVE-2026-43740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, vision...

Linux Distros Unpatched Vulnerability : CVE-2026-47304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-47304 Note that...

SUSE SLES12 Security Update : kernel (Live Patch 82 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3011-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3011-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.307 fixes various security issues The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel (Live Patch 26 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:2997-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2997-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.112 fixes various security issues The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel (Live Patch 41 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:3001-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3001-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.169 fixes various security issues The following security issues were fixed: ...

RHEL 8 : kernel (RHSA-2026:39984)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39984 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtmutex: Use waiter::task...

CVE-2026-52892

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST,...

CVE-2026-52870 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enabletasks for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recordin...

DEBIAN-CVE-2026-56135

Bulletin has no description...

DEBIAN-CVE-2026-42617

Bulletin has no description...

DEBIAN-CVE-2026-56136

Bulletin has no description...

CVE-2026-46485

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized...

GHSA-4VPF-W7QV-5H3Q MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

Unvalidated notetype Parameter in mcissueupdate SOAP Endpoint Allows creation of TIMETRACKING and REMINDER Notes. The SOAP path passes the user-supplied notetype integer directly to bugnoteadd without validating that the user is authorized to create that type of note. If the user's access level i...

CVE-2026-49988

Repomix’s MCP server flow attach_packed_output followed by read_repomix_output can register and expose arbitrary local files (.json/.txt/.md/.xml) without running the secret-scan check, bypassing the file_system_read_file boundary. The root cause is that this path validates only by extension/form...

CVE-2026-53518

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorizationcode grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two...

USN-8553-1: .NET vulnerabilities

Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue to elevate privileges. CVE-2026-47300 Levi Broderick discovered that .NET did not properly handle XML encryption during parsing. An attacker could possibly use this issu...

GHSA-M7PH-9558-MRX3 MantisBT: REST API unauthorized Issue status change

A MantisBT user having $gupdatebugthreshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $gsetstatusthreshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...