CVE-2026-96347: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

AlmaLinux 9.2 [TuxCare] Security Update: nspr / nspr-devel / nss / nss-devel / nss-pkcs11-devel / etc (ALMALINUX9.2:CLSA-2024:1722977316)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1722977316 advisory. - Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could potentially allow an attacker to...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2026:1786960012)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786960012 advisory. - SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a...

AlmaLinux 9.6 [TuxCare] Security Update: grafana-pcp Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779109358)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779109358 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates a...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789464832)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789464832 advisory. - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-3149)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3149 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-425...

AlmaLinux 9.6 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790783892)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790783892 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-3381...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784133121)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784133121 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates a...

CVE-2026-47097: Use of Hard-coded Cryptographic Key

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...

MiracleLinux 8 : coreutils-8.30-21.el8_10 (AXSA:2026-1940:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1940:06 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly fr...

CVE-2026-10764: Use of Hard-coded Cryptographic Key

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data...

CVE-2026-97259: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

PT-2026-103194

Name of the Vulnerable Software and Affected Versions SiteSkite versions prior to 2.2.0 Description An unauthenticated remote code execution issue exists due to a critical chain involving API-key autologin and the eval function within the MCP component. This allows an attacker to execute arbitrar...

CentOS Linux 8 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS-STREAM8:CLSA-2025:1759330475)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1759330475 advisory. - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key...

CVE-2026-103235: Improperly Controlled Modification of Dynamically-Determined Object Attributes

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied...

PT-2026-103129

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 Description Apache WSS4J fails to properly validate bounds for derived-key lengths and offsets provided by a user. This flaw allows...

AlmaLinux 9.2 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790168428)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790168428 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-3381...

AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ALMALINUX9.2:CLSA-2025:1759865335)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759865335 advisory. - Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS8.4:CLSA-2026:1773405202)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1773405202 advisory. - When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and...