ROS-20260306-73-0016

A vulnerability in the bus component of the Linux operating system kernel is associated with a memory re-release error. Exploitation of the vulnerability may allow an attacker to affect confidentiality, integrity and availability of protected information...

ROS-20260306-73-0021

A vulnerability in the aoedevdowndev function of the Linux kernel is related to improper resource release. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

PT-2026-23661

Name of the Vulnerable Software and Affected Versions AWS Lambda affected versions not specified Description The url.Parse function did not properly validate the host or authority component of URLs, allowing the acceptance of invalid URLs. This issue impacts the standard library in 27 Lambda base...

QuickJS 安全漏洞

QuickJS is a small and embeddable JavaScript engine developed by the QuickJS open-source project. The QuickJS 2025-09-13 version contains a security vulnerability. This vulnerability arises from improper memory release when processing specially crafted JavaScript inputs under low memory...

PT-2026-23662

Name of the Vulnerable Software and Affected Versions AWS Lambda affected versions not specified Description A flaw exists in AWS Lambda base images utilizing stdlib. Specifically, when validating a certificate chain with multiple email address constraints that share common local portions but...

RHEL 9 : OpenShift Container Platform 4.19.25 (RHSA-2026:3391)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3391 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

ROS-20260306-73-0011

A vulnerability in the sun8icecipherprepare function of the drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c module of the Linux kernel is related to incorrect resource release. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

PT-2026-23663

Name of the Vulnerable Software and Affected Versions AWS Lambda affected versions not specified Description A flaw exists where certificate verification can lead to a program crash. This occurs when a certificate within a chain lacks a DNS name while another certificate in the same chain has...

PT-2026-23664

Name of the Vulnerable Software and Affected Versions AWS Lambda versions affected versions not specified Description On Unix platforms, when listing directory contents using File.ReadDir or File.Readdir, the returned FileInfo could reference a file outside the root directory in which the file wa...

ROS-20260306-73-0007

A vulnerability in the kernel/trace/bpftrace.c module of the BPF subsystem of the Linux kernel is related to incorrect resource release. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260306-73-0027

A vulnerability in the patavia function of the Linux kernel is related to improper resource release. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2025-69654

A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 2025-12-11,qjs interpreter using the -m option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JSFreeRuntime...

Fedora 43 : nextcloud (2026-ae48fa379e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ae48fa379e advisory. 32.0.6 release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

The vulnerability of the iso_listen_bis() function in the net/bluetooth/iso.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to cause a service failure.

The vulnerability of the isolistenbis function in the net/bluetooth/iso.c module of the Linux kernel’s Bluetooth subsystem is related to the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-3606

A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function adddatasegment of the file src/ettercap/utils/etterfilter/efoutput.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this...

PYSEC-2026-112

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?camefrom=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0...

CVE-2026-29081 Frappe: Possibility of SQL Injection due to improper fieldname sanitization

Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and...

Gogs: DOM-based XSS via milestone selection

Summary It was confirmed in a test environment that an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page /issues/new, a DOM-Based XSS is triggered. Impact Theft of information accessible in the victim...

CVE-2026-28413

The CVE affects Plone via the Products.isurlinportal replacement. Before versions 2.1.0, 3.1.0, and 4.0.0, a login redirect can be manipulated when the came_from parameter contains more than two forward slashes (e.g., /login?came_from=////evil.example), leading to an open redirect. The issue has ...

EUVD-2026-9871

The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains. Prior to version 3.0.0, a flaw in the token vesting contracts allows users to access tokens that should still be locked according to their vesting schedule. This issue has been patched in...