CVE-2026-60124 MISP importModule missing authorization allows read-only users to modify events via misp_standard imports

An authorization bypass in MISP’s EventsController::importModule allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the mispstandard format, the write path did not verify eve...

EUVD-2026-42239

An authorization bypass in MISP’s EventsController::importModule allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the mispstandard format, the write path did not verify eve...

CVE-2026-14454 Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the address space, which fails and kills the process. ...

RLSA-2026:36364 Important: nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

nginx:1.24 security, bug fix, and enhancement update

An update is available for nginx, module.nginx. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other...

BIT-PYTHON-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

Important: Red Hat Security Advisory: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

[SECURITY] Fedora 43 Update: perl-Compress-Raw-Bzip2-2.218-1.fc43

This module provides a Perl interface to the bzip2 compression library. It is used by IO::Compress::Bzip2...

PT-2026-56451

MISP’s importModule path used getEnabledModule to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules. As a result, an authenticated user from an organisation that was not allowed to use a module restricted v...

ALSA-2026:36639 Important: nginx:1.26 security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

PT-2026-56572

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 Description A limited authentication bypass by spoofing exists within the HTTPS module of the software. Recommendations Update to version 2025.0.7 or...

The vulnerability of the reading module for FTXT format graphic files in the console-based graphic editor ImageMagick allows a hacker to induce a service failure.

The vulnerability of the FTXT graphic file reading module in the console-based graphic editor ImageMagick is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the ets_qdisc_change() function in the net/sched/sch_ets.c module of the network/sched/sch_ets subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the etsqdiscchange function in the net/sched/schets.c file, within the network scheduling subsystem of the Linux kernel, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Important: nginx:1.26 security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

The vulnerability of the dsa_switch_parse() function in the net/dsa/dsa.c module allows a hacker to cause a service failure in systems with a distributed kernel architecture of the Linux operating system.

The vulnerability of the dsaswitchparse function in the net/dsa/dsa.c module relates to the improper release of resources in support for Linux operating system’s distributed kernel architecture. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the lib/parse.js component in the Node QS string analysis and transformation library allows a attacker to cause a service failure.

The vulnerability of the lib/parse.js component, a library for analyzing and transforming string queries in Node QS, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-56573

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.0.7 MOVEit Transfer versions 2025.1.0 through 2025.1.2 Description An incorrect authorization issue exists within the Audit User module, which may allow unauthorized access or actions. Recommendations...

Linux Distros Unpatched Vulnerability : CVE-2026-14895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace...

Amazon Linux 2 : opensc, --advisory ALAS2-2026-3492 (ALAS-2026-3492)

The version of opensc installed on the remote host is prior to 0.19.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3492 advisory. A flaw has been found in OpenSC up to 0.26.1. This affects the function testkpgencertwrite of the file src/tools/pkcs11-tool.c of t...