Linux Distros Unpatched Vulnerability : CVE-2026-14456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3602-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3602-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: -...

SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:3604-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3604-1 advisory. This update for kubevirt fixes the following issue: - CVE-2026-13622: virt-handler migration proxy follows symlinks, allowing container esca...

SUSE SLED15 / SLES15 Security Update : gzip (SUSE-SU-2026:3592-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3592-1 advisory. - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state...

PT-2026-76577

Summary token-optimizer-mcp is vulnerable to OS command injection in the smart user tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/pass...

...[ More ]

A proof of concept exploit for an unauthenticated PHP object injection vulnerability in WooCommerce Subscriptions versions prior to 9.1.0 when High-Performance Order Storage is enabled. Attacker-controlled data supplied through the User-Agent header can undergo unsafe deserialization during...

...[ More ]

A proof of concept exploit for an unauthenticated remote code execution vulnerability in the Fabrik Joomla component versions prior to 4.6.8. A request-controlled filter eval flag can cause an attacker-supplied filter value to be passed to PHP eval, allowing arbitrary PHP and ultimately shell...

...[ More ]

A proof of concept exploit for an out-of-bounds memory access vulnerability in the QEMU Hyper-V synthetic debugger device. The handlerecvmsg function fails to verify the length returned by cpuphysicalmemorymap before copying a received debug datagram into the mapped region. A guest able to invoke...

MiracleLinux 9 : ruby:4.0 (AXSA:2026-1542:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1542:01 advisory. ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses CVE-2026-42245 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via...

The vulnerability of the Load Testing module for Web apps within the Oracle Application Testing Suite allows a hacker to gain full control over the application.

The vulnerability of the Load Testing module for web apps within the Oracle Application Testing Suite relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the TCP protocol...

The vulnerability of the “Bill Issues” component of the Oracle Materials Management module, which deals with material specifications, product composition, and technological processes, allows a perpetrator to gain full control over the application. This vulnerability is part of the Oracle E-Business Suite automation system.

The vulnerability of the Bill Issues component in the Oracle Materials Management module, which handles material specifications, product composition, and technological processes, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain full contr...

SUSE SLED15: openssh / openssh-askpass-gnome / openssh-clients / openssh-common / etc (SUSE-SU-2026:3605-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3605-1 advisory. - Backported support for the mlkemx25519 key exchange from upstream jscPED-16473. - CVE-2026-59995: sftp:...

RockyLinux 9 : php:8.2 (RLSA-2026:40416)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40416 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

nodejs:24 security update

nodejs 1:24.18.0-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 5.9.0 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223388 RHEL-223907 RHEL-223792 1:24.18.0-3 - Backport patch update sqlite to 3.53.4 Fixes: CVE-2026-11824, CVE-2026-11822...

nodejs:22 security update

nodejs 1:22.23.1-3 - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 1:22.23.1-3 - Backport patch: update sqlite to 3.53.4 Fix: CVE-2026-11824, CVE-2026-11822 Resolves: RHEL-224135 RHEL-224144 1:22.23.1-2 -...

BGA: A Noise-Immune Neural Distillation Framework for Malicious Signature Extraction in High-Entropy Encrypted Flows

To mitigate attention dilution in high-entropy TLS 1.3 flows, we propose BGA, a noise-immune neural distillation framework for encrypted threat intelligence.The methodology first employs Analysis of Variance ANOVA to decouple high-discriminatory control-plane features - specifically industrial...

PT-2026-75931

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

PT-2026-71958

A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack ma...

PT-2026-71957

A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can b...

PT-2026-75925

Summary token-optimizer-mcp is vulnerable to OS command injection in the smart user tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/pass...