RHSA-2026:38090 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:38017 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: vcluster, cilium-cli, oras-fips, cloudbeat, ratify-fips, argo-cd, helm-diff, kyverno, drone-fips, steampipe, kgateway-fips, linkerd2, chartmuseum, cloudbeat-fips, grafana-operator-fips, kgateway, conftest-fips, helmfile, teleport, zot, kubescape-server-fips, opa,...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: gogatekeeper, argocd-image-updater, zot, cilium-cli, k8ssandra-client, helm-operator, helm, oras, kyverno, opa-envoy, trivy-operator, linkerd2, gatekeeper, argo-cd, zarf, ratify, tigera-operator, falcoctl, headlamp, rancher-fleet, flux-source-controller, rancher, opa...

CVE-2026-15335

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter form in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2026-43143

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter form in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15335

The Booking Package WordPress plugin is vulnerable up to version 1.7.20 due to insufficient escaping on the email parameter in the REST endpoint /wp-json/booking-package/v1/request, allowing unauthenticated SQL injection. Root cause: user-supplied email input reaches the SQL sink without proper e...

CVE-2026-15335 Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter form in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

GHSA-FRRJ-87JH-2772 vulnerabilities

Vulnerabilities for packages: cilium-cli, kube-vip...

GHSA-2WC2-FM75-P42X vulnerabilities

Vulnerabilities for packages: open-webui, datadog-agent, kubeflow-pipelines-visualization-server...

[SECURITY] Fedora 44 Update: sssd-2.13.1-2.fc44

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

MAL-2026-10185 Malicious code in authvaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...

Malicious code in authvaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...

PT-2026-57393

Name of the Vulnerable Software and Affected Versions Booking Package versions prior to 1.7.21 Description Insufficient escaping of user-supplied parameters and lack of preparation in SQL queries allow unauthenticated attackers to perform SQL Injection. This occurs via the email parameter in the...

Fedora 44 : acl (2026-6b9a652463)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b9a652463 advisory. rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370 Resolves: CVE-2026-54369 Resolves: CVE-2026-54370 Tenable has extracted the preceding...

MAL-2026-10187 Malicious code in jscrambler (npm)

Supply-chain compromise of the official jscrambler npm client, a legitimate JavaScript obfuscation tool with roughly 60K downloads per month. Version 8.14.0 was published from the legitimate publisher account jscrambler / [email protected], which points to an account or CI compromise rather tha...

Fedora 44 : attr (2026-daa458d11d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-daa458d11d advisory. rebase to v2.6.0 to fix CVE-2026-54371 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

Malicious code in jscrambler (npm)

Supply-chain compromise of the official jscrambler npm client, a legitimate JavaScript obfuscation tool with roughly 60K downloads per month. Version 8.14.0 was published from the legitimate publisher account jscrambler / [email protected], which points to an account or CI compromise rather tha...

Fedora 44 : prometheus (2026-01a1840582)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-01a1840582 advisory. Update to 3.13.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...