FreeBSD : Prosody XMPP server advisory 2026-04-29 (a420f545-442c-11f1-b9b5-589cfc0dc9a2)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a420f545-442c-11f1-b9b5-589cfc0dc9a2 advisory. The Prosody team reports: Traffic patterns were discovered which can cause Prosody to consume excessive...

SUSE SLES15 Security Update : glibc-livepatches (SUSE-SU-2026:1662-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:1662-1 advisory. This update for glibc-livepatches fixes the following issue: Security fixes: - CVE-2026-4046: assertion failure when converting inputs may be used to...

Linux Distros Unpatched Vulnerability : CVE-2026-31771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcievent: move wake reason storage into validated event handlers hcistorewakereason is called from hcieventpacket immediately after stripping the HCI...

Linux Distros Unpatched Vulnerability : CVE-2026-43015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: macb: fix clk handling on PCI glue driver removal platformdeviceunregister may still want to use the registered clks during runtime resume callback. Note...

Linux Distros Unpatched Vulnerability : CVE-2026-31778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: caiaq: fix stack out-of-bounds read in initcard The loop creates a whitespace-stripped copy of the card shortname where len id is used for the bounds chec...

PT-2026-36686

Name of the Vulnerable Software and Affected Versions FormGent versions prior to 1.9.3 Description The FormGent plugin for WordPress allows unauthenticated attackers to delete arbitrary files within the formgent uploads directory. This occurs because the '/wp-json/formgent/responses/attachments'...

PT-2026-36605

A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index.ts of the component sync ea from file. Such manipulation of the argument ea name leads to path traversal. The attack can be launched...

Linux Distros Unpatched Vulnerability : CVE-2026-31777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: ctxfi: Check the error for index mapping The ctxfi driver blindly assumed a proper value returned from daiodeviceindex, but it's not always true. Add a...

RHCOS 4 : OpenShift Container Platform 4.16.55 (RHSA-2026:0418)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0418 advisory. - runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-31133 - runc: container escape with malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-31782

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/x86: Fix potential bad containerof in intelpmuhwconfig Auto counter reload may have a group of events with software events present within it. The software...

Linux Distros Unpatched Vulnerability : CVE-2026-43027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrackhelper: pass helper to expect cleanup nfconntrackhelperunregister calls nfctexpectiteratedestroy to remove expectations belonging to the...

Linux Distros Unpatched Vulnerability : CVE-2026-43034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnxten: set backing store type from query type bnxthwrmfuncbackingstoreqcapsv2 stores resp-type from the firmware response in ctxm-type and later uses that valu...

Linux Distros Unpatched Vulnerability : CVE-2026-43038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2-cb in ip6errgenicmpv6unreach Sashiko AI-review observed: In...

Linux Distros Unpatched Vulnerability : CVE-2026-31735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iommupt: Fix short gather if the unmap goes into a large mapping unmap has the odd behavior...

Linux Distros Unpatched Vulnerability : CVE-2026-43024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftables: reject immediate NFQUEUE verdict nftqueue is always used from userspace nftables to deliver the NFQUEUE verdict. Immediately emitting an...

RHCOS 4 : OpenShift Container Platform 4.21.1 (RHSA-2026:2082)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:2082 advisory. - golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 Note that Nessus has not tested for this issue but has...

SUSE-SU-2026:21453-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix one security issue The following security issue was fixed: - CVE-2026-31431: The copy.fail security issue is fixed by revert to operating out-of-place in algifaead bsc1262573...

MINI-JCPH-FW8G-M26F

Bulletin has no description...

CVE-2026-31725

A flaw was found in the Linux kernel's usb: gadget: fecm component. When a USB gadget function unbinds, the associated netdevice may not be properly de-parented from the destroyed gadget device. This can lead to dangling symbolic links in the /sys/class/net/ directory, potentially causing issues...

CVE-2026-7591

A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. The attac...