EUVD-2026-46300

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

CVE-2026-64824

CVE-2026-64824 affects Home Assistant Core prior to 2026.6.0. A path-traversal flaw exists in the backup-restore function that can write files to arbitrary absolute filesystem paths via a crafted tar archive using a SYMTYPE entry with a benign member name and an absolute linkname outside the extr...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: bind: bind-9.18.50-22.hum1 aarch64, x8664 bind-chroot-9.18.50-22.hum1 aarch64, x8664 bind-devel-9.18.50-22.hum1 aarch64, x8664 bind-dnssec-utils-9.18.50-22.hum1 aarch64, x8664...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: prism, kubeflow-centraldashboard, saf, npm, pulumi, lerna, sqlpad, code-server...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.6 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.30 bug fix and security update

Red Hat OpenShift Container Platform release 4.20.30 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

AlmaLinux 10 : c-ares (ALSA-2026:42096)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:42096 advisory. c-ares: c-ares: Use-after-free / double-free in query-completion handling CVE-2026-33630 Tenable has extracted the preceding description block directly from the...

Linux Distros Unpatched Vulnerability : CVE-2026-15166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service CVE-2026-15166 Note that Nessus relies on the...

PT-2026-61991

Name of the Vulnerable Software and Affected Versions react-server-dom-webpack versions 19.0.0 through 19.0.7 react-server-dom-webpack versions 19.1.0 through 19.1.8 react-server-dom-webpack versions 19.2.0 through 19.2.7 react-server-dom-parcel versions 19.0.0 through 19.0.7...

Oracle Linux 9 : glib2 (ELSA-2026-42089)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-42089 advisory. - Fix CVE-2026-58016: broken node element nesting validation in D-Bus introspection XML parsing Tenable has extracted the preceding description block directly...

RHEL 9 : RHEL AI 3.5 RPM runtime CVE fix - aom (Important) (RHSA-2026:42875)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42875 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A securit...

MAL-2026-10929 Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d44486dc374cb50abaad84a7086859ce3c2a7e5b17a790aae5b426c4cf2a1e0 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MGASA-2026-0274 Updated php packages fix a security vulnerability

The updated php packages fix a security issue: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD. CVE-2026-14355...

Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...

MGASA-2026-0281 Updated python-nltk packages fix security vulnerabiliy

URL-Encoded Path Traversal in nltk.data.load Allows Arbitrary Local File Read. CVE-2026-54293...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-8.2.hum1 aarch64, x8664 busybox-petitboot-1.37.0-8.2.hum1 aarch64, x8664 busybox-shared-1.37.0-8.2.hum1 aarch64, x8664 busybox-1.37.0-8.2.hum1.src src Security Fixes:...

Malicious code in nemopush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b1717e80fb3423ed246cbcaacb39cfa13526d2f2520a8de1229cd3388e391059 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

Linux Distros Unpatched Vulnerability : CVE-2026-64066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued...

Linux Distros Unpatched Vulnerability : CVE-2026-64083

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as...