kernel security, bug fix, and enhancement update

4.18.0-553.155.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Nodemailer 9.0.0 Arbitrary File Read / Server-Side Request Forgery

Nodemailer versions 9.0.0 and below suffer from arbitrary file read and server-side request forgery vulnerabilities. Exploit Title: Nodemailer 9.0.0 - File Read/ SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/nodemailer/nodemailer Software...

FFmpeg RIST Protocol Heap Buffer Overflow

FFmpeg versions 4.4 through 9.0 contain a heap buffer overflow vulnerability in the RIST protocol reader when built with librist support. A remote unauthenticated attacker can send oversized RIST payloads to an affected async:rist:// receiver, causing attacker-controlled data to be written beyond...

PT-2026-79065

Name of the Vulnerable Software and Affected Versions Plate versions prior to 53.3.2 Description When converting attacker-controlled HTML through the htmlToDocxBlob function in a server-side or privileged environment, the @platejs/docx-io module fetches remote image URLs. This behavior allows for...

Oracle Linux 8 : perl:5.32 (ELSA-2026-48225)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48225 advisory. - Fix CVE-2025-40909 - Clone dirhandles without fchdir perl-Algorithm-Diff - Fix CVE-2026-9538: Denial of Service via crafted tar header with large entry size...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1596:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1596:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

RockyLinux 9 : mysql:8.4 (RLSA-2026:56973)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56973 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...

Linux Distros Unpatched Vulnerability : CVE-2026-28984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe...

RHEL 9 : php:8.3 (RHSA-2026:57539)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57539 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection vi...

Linux Distros Unpatched Vulnerability : CVE-2026-64757

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS...

Oracle Linux 9 : mysql:8.4 (ELSA-2026-56973)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-56973 advisory. mecab 0.996-3.4 - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: 2182069...

RHEL 8 : php:8.2 (RHSA-2026:57574)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57574 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection vi...

The vulnerability of the shmem module in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the shmem module in the Linux operating system’s kernel is related to the exposure of information. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the pgcrypto module in the PostgreSQL database management system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the process_v2_sparse_read() function in the net/ceph/messenger_v2.c kernel module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the processv2sparseread function in the net/ceph/messengerv2.c kernel module of the Linux operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-64783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS...

Linux Distros Unpatched Vulnerability : CVE-2026-64719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPad...

Incorrect Authorization

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the SpringTemplateLoader process. An attacker can access sensitive files outside the intended template directory by supplying a crafted view name containing backslash sequences. This is only exploitable if a...

Security update for go1.26 (important)

openSUSE security update: security update for go1.26 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21593-1 Rating: important References: bsc1255111 bsc1266609 bsc1275024 bsc1275025 bsc1275026 bsc1275028 bsc1275029 bsc1275032 bsc1275033 bsc1275034...