PT-2026-67233

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bcpg-fips versions prior to 1.0.13 Bouncy Castle for Java FIPS BC-FJA bcpg-fips versions prior to 2.0.13 Boun...

CVE-2026-69247: Observable Timing Discrepancy

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

Oracle Linux 10 : kernel (ELSA-2026-23329)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-23329 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Oracle Linux 10 : gstreamer1-plugins-good (ELSA-2026-49508)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49508 advisory. 1.26.7-2.2 - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling CVE-2026-5056 Resolves: RHEL-222333 Tenable has extracted th...

Oracle Linux 9 : frr (ELSA-2026-49527)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49527 advisory. 8.5.3-15.1 - Resolves: RHEL-193234 - input validation fixes for EVPN NLRI and ENCAP/VNC packet parsing 8.5.3-15 - Resolves: RHEL-176258 - AVC when reading user...

kernel security update

4.18.0-553.150.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2026-69240: Improper Neutralization of Special Elements used in an SQL Command

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...

Oracle Linux 10 : perl-DBI (ELSA-2026-49514)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-49514 advisory. - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders Tenable has extracted th...

Oracle Linux 10 : perl-Archive-Tar (ELSA-2026-49523)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-49523 advisory. - Fix CVE-2026-9538: cap per-entry declared size during archive reading to prevent memory DoS Tenable has extracted the preceding description block directly...

Oracle Linux 8 : frr (ELSA-2026-49511)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49511 advisory. - Fix EVPN and ENCAP/VNC packet parsing validation CVE-2026-37460 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 7 : rsync (ELSA-2026-25172)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-25172 advisory. - Backport fix for CVE-2026-41035 Orabug: 39542074 - Fix CVE-2024-12087 Orabug: 38771262 Tenable has extracted the preceding description block directly from th...

Oracle Linux 10 : thunderbird (ELSA-2026-49621)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-49621 advisory. 140.13.0-1.0.1 - Add Oracle prefs 140.13.0-1 - Update to 140.13.0 ESR Tenable has extracted the preceding description block directly from the Oracle...

Oracle Linux 10 : p11-kit (ELSA-2026-49668)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49668 advisory. 0.26.4-1 - Rebase to 0.26.4 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

Oracle Linux 8 : php:7.4 (ELSA-2026-47750)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47750 advisory. libzip php 7.4.33-5 - Fix Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php-pear php-pecl-apcu php-pecl-rrd...

Oracle Linux 10 : php (ELSA-2026-48170)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48170 advisory. 8.3.32-1 - rebase to 8.3.32 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

CVE-2026-68582

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

Oracle Linux 8 : nodejs:24 (ELSA-2026-47060)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47060 advisory. - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-194176 RHEL-194179 RHEL-208658 Tenable has...

Oracle Linux 8 : kernel (ELSA-2026-47011)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-47011 advisory. 4.18.0-553.148.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to t...

Oracle Linux 8 : javapackages-tools:201801 (ELSA-2026-41948)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-41948 advisory. - Resolves: CVE-2019-10086, CVE-2025-48734 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Oracle Linux 7 : compat-libtiff3 (ELSA-2026-24992)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-24992 advisory. - Backport fix for CVE-2026-4775 Orabug: 39535879 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...