CVE-2026-56740 vulnerabilities

Vulnerabilities for packages: apache-pulsar, confluent-kafka-jre-bcfips, spark-kubernetes-operator, apache-pulsar-fips, apache-camel-karavan-devmode, spark, spark-kubernetes-operator-fips, apache-nifi, zookeeper, kafka, pinot, hadoop-fips, spark-fips, zookeeper-fips, tez, confluent-kafka,...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

EUVD-2026-45896

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable. The fallback...

CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generateid silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The...

TencentOS Server 3: nginx:1.24 (TSSA-2026:0618)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0618 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Fedora 45 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-d1cd8e3d25)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-d1cd8e3d25 advisory. nginx-mod-fancyindex: Rebuild for 1.30.4 nginx-mod-modsecurity: Rebuild for 1.30.4 nginx-mod-naxsi: Rebuild for 1.30.4 nginx-mod-headers-more: Rebui...

PT-2026-61259

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the parport subsystem where port devices are registered before they are fully initialized. This allows client drivers, such as lp, to attach to ports that are...

GO-2026-5953 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-5990 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery

Anyquery: Local File Read LFR via Unrestricted SQLite Virtual Table Modules in Server Mode in github.com/julien040/anyquery...

Improper Access Control

github.com/julien040/anyquery is vulnerable to Improper Access Control. The vulnerability is due to missing input sanitization and insufficient access control over the built-in SQLite virtual table modules, which allows an unauthenticated attacker to create virtual tables that reference arbitrary...

jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update is available for jackson-jaxrs-providers, jackson-annotations, jackson-databind, jackson-core, jackson-modules-base. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

RHSA-2026:40895 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

Bulletin has no description...

RockyLinux 9 : jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RLSA-2026:40895)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:40895 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 jackson-databind: jackson-databind: Arbitrary code...

ALSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1922)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1922 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives...

CVE-2026-46421

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

PYSEC-2026-3624

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

CVE-2026-58659

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: perl: perl-5.42.2-524.3.hum1 aarch64, x8664 perl-Attribute-Handlers-1.03-524.3.hum1 noarch perl-AutoLoader-5.74-524.3.hum1 noarch perl-AutoSplit-5.74-524.3.hum1 noarch perl-B-1.89-524.3.hum1...

Oracle Linux 8 : glibc (ELSA-2026-33126)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-33126 advisory. - CVE-2026-5450: Fix buffer overflow in scanf RHEL-172700 - Add tests for CVE-2026-4437 and CVE-2026-4438 RHEL-173358 - CVE-2026-4046: Fix assertion failure in...