CVE-2026-72580

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...

CVE-2026-72580

The CVE-2026-72580 entry details an OS command injection in the duhow/xiaoai-patch for Xiaomi smart speakers running the patch. The vulnerability arises because the /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without san...

CLSA-2026-1786358468 TuxCare security update for org.eclipse.jetty (2 CVEs)

TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 10.0.28.tuxcare0003...

Security Bulletin:Vulnerability in libtiff affects IBM Netezza Appliance

Summary The libtiff package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVEs CVE-2023-52355, CVE-2025-9900, CVE-2025-8176 Vulnerability Details CVEID:CVE-2023-52355 DESCRIPTION: An out-of-memory flaw was found in libtiff that could be triggered by passing...

Security Bulletin:Vulnerability in React affects IBM Netezza Appliance

Summary The React package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-33244, CVE-2026-33245, CVE-2026-34077, CVE-2026-40181, CVE-2026-42211, CVE-2026-42342 Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for...

CLSA-2026-1786355016 TuxCare security update for ch.qos.logback:logback-core (1 CVE)

TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.2.3-tuxcare.1...

CLSA-2026-1786342108 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 4 org.springframework packages to address 4 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.3...

Exploit for CVE-2026-64564

SCTPhantom — Linux kernel SCTP ASCONF use-after-free tracking...

PT-2026-69464

Name of the Vulnerable Software and Affected Versions duhow/xiaoai-patch versions prior to commit fb07049 Description An OS command injection flaw allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers. The issue occurs because the /mute and /unmute endpoints in...

OPENSUSE-SU-2026:11489-1 java-25-openj9-25.0.4.0-1.1 on GA media

These are all security issues fixed in the java-25-openj9-25.0.4.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11487-1 java-1_8_0-openj9-1.8.0.502-1.1 on GA media

These are all security issues fixed in the java-180-openj9-1.8.0.502-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11490-1 libpcp-devel-6.3.8-3.1 on GA media

These are all security issues fixed in the libpcp-devel-6.3.8-3.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-72581: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...

Photon OS 5.0: Binutils PHSA-2025-5.0-92-0663

An update of the binutils package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-92-0663. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Python3 PHSA-2024-5.0-91-0223

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0223. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-72522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode...

Photon OS 5.0: Rust PHSA-2023-5.0-91-0177

An update of the rust package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0177. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 10 : libarchive (ELSA-2026-52675)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-52675 advisory. - Related: CVE-2026-14164 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-68113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/gfx12: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit...

Photon OS 5.0: Glib PHSA-2026-5.0-90-0763

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...