SUSE SLES15 Security Update : kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3393-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3393-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.55 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-65423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

Fedora 44 : nextcloud (2026-df06189438)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-df06189438 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

AgenticRepair: Multi-Faceted Program Context Engineering for Agentic Vulnerability Repair

Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report. Recent agentic AI approaches have shown promising results in automated program repair. However, vulnerability repair demands richer program context than general b...

Linux Distros Unpatched Vulnerability : CVE-2026-66756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommende...

cJSON Utils Heap Buffer Overflow

The vulnerability of the applypatch function in the cJSONUtils.c component of the C language JSON object handling library is related to an incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

Linux Distros Unpatched Vulnerability : CVE-2026-9672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Note that Nessus relies on the presence of the package as reported by the vendor...

Important Photon OS Security Update - PHSA-2026-5.0-92-0936

Updates of 'libtiff' packages of Photon OS have been released...

Exploit for CVE-2026-60004

🚨 CVE-2026-60004 - RCE Critical Remote Code Execution...

CVE-2026-67527

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-67527

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-67527

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-67527

OpenProject prior to v17.6.0 is affected by an improper access control vulnerability in PATCH /api/v3/work_packages/{id} via the _links.fileLinks parameter.Authenticated users with edit_work_packages but without manage_file_links could resolve Storages::FileLink records by raw id, detach or hard-...

CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue Fixed an issue where formatting list of tuples leads to denial of service bsc1268597. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...

ROOT-APP-NPM-CVE-2026-54270 CVE-2026-54270 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-54270 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting

The two Chrome updates in June patched more bugs than the 23 updates before them. Now, Google is ramping up its patching schedule thanks to AI-assisted vulnerability discovery...

SUSE CVE-2026-24000

Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof their apparent IP address and bypass per-IP rate limitin...