SUSE SLES15 Security Update : kubevirt-1.6 (SUSE-SU-2026:2401-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2401-1 advisory. This update for kubevirt-1.6 fixes the following issues Update to version 1.6.6, fixes various go embedded security issues: -...

SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:2407-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2407-1 advisory. This update for containerized-data-importer rebuilds the current sources against latest go security release and the images against the lates...

SUSE SLES15 Security Update : rootlesskit (SUSE-SU-2026:2452-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2452-1 advisory. This update for rootlesskit rebuilds it against the current go security release. Tenable has extracted the preceding description block...

SUSE SLES15 Security Update : helm (SUSE-SU-2026:2439-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2439-1 advisory. This update for helm rebuilds it against the current go security release. Tenable has extracted the preceding description block directly fro...

SUSE SLES15 Security Update : buildah (SUSE-SU-2026:2415-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2415-1 advisory. This update for buildah rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

anki-release (>=25.6.0b2, <=25.9.2) potentially affected by CVE-2026-59153 via aqt (>=25.6.0b2, <=25.9.2)

aqt PYPI version =25.6.0b2, =25.6.0b2, =25.9.2 Source cves: CVE-2026-59153 Source advisory: SNYK:PYTHON-AQT-17675230...

anki-release (>=25.6.0b2, <=25.9.2) potentially affected by CVE-2026-59153 via aqt (>=25.6.0b2, <=25.9.2)

aqt PYPI version =25.6.0b2, =25.6.0b2, =25.9.2 Source cves: CVE-2026-59153 Source advisory: GHSA-869J-R97X-HX2G...

anki-release (>=25.6.0b2, <=25.9.2) potentially affected by CVE-2026-59153 via aqt (>=25.6.0b2, <=25.9.2)

aqt PYPI version =25.6.0b2, =25.6.0b2, =25.9.2 Source cves: CVE-2026-59153 Source advisory: OSV:GHSA-869J-R97X-HX2G...

anki-release (>=25.6.0b2, <=25.9.3) potentially affected by CVE-2026-58266 via aqt (>=25.6.0b2, <=25.9.3)

aqt PYPI version =25.6.0b2, =25.6.0b2, =25.9.3 Source cves: CVE-2026-58266 Source advisory: OSV:GHSA-CW6H-FFMH-X6VH...

anki-release (>=25.6.0b2, <=25.9.3) potentially affected by unknown CVE via aqt (>=25.6.0b2, <=25.9.3)

aqt PYPI version =25.6.0b2, =25.6.0b2, =25.9.3 Source cves: unknown CVE Source advisory: GHSA-CW6H-FFMH-X6VH...

anki-release (>=25.6.0b2, <=25.9.3) potentially affected by CVE-2026-58266 via aqt (>=25.6.0b2, <=25.9.3)

aqt PYPI version =25.6.0b2, =25.6.0b2, =25.9.3 Source cves: CVE-2026-58266 Source advisory: SNYK:PYTHON-AQT-17675231...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking in the releasewritelock and releasereadlock functions. An attacker can disrupt synchronization guarantees and exploit data races or cause denial of service by invoking these functions from unauthorized threads or withou...

CVE-2026-50559

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons %3B to smuggle matrix parameters past the security layer,...

CVE-2026-49344

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine /admin/queries/execute accepts a JSON DSL from / select / filters / traverse / output, translates it into an Eloquent query, and returns results as JSON...

CVE-2026-48089

CVE-2026-48089 affects DevGuard. Before patch 1.4.2, an authenticated user, including from other orgs with no membership, could write and manage VEX rules and related vulnerability-triage endpoints on assets marked public. The root cause is improper authorization for public assets, enabling write...

EUVD-2026-36542

parse-server: Relation $relatedTo query bypasses protectedFields and owning-object ACL...

EUVD-2026-38071

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine /admin/queries/execute accepts a JSON DSL from / select / filters / traverse / output, translates it into an Eloquent query, and returns results as JSON...

kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service

A flaw was found in the Linux kernel's bonding driver. A local attacker with low privileges could exploit a use-after-free vulnerability in the bondxmitbroadcast function. This occurs due to a race condition during concurrent slave enslave/release operations, which can lead to the original socket...

AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution. Steer the agent to load an attacker's web page, and that page's JavaScript can reach a privileged local service on the same machine and spawn a...

CVE-2026-4027 FlexNet Manager Suite Attachment File Disclosure

A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that could allow unauthorized access to attachment files due to insufficient access control...