Photon OS 5.0: Dotnet PHSA-2026-5.0-91-0778

An update of the dotnet package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0778. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 8 : thunderbird (ELSA-2026-49922)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-49922 advisory. 140.13.0-1.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.13.0 - Add OpenELA debranding 140.13.0-1 - Update to 140.13.0 ESR...

ROS-20260805-73-0011

The vulnerability of the deviceadd function in Linux kernel is related to memory release errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-64575: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

Photon OS 5.0: Httpd PHSA-2024-5.0-91-0242

An update of the httpd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0242. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2023-5.0-91-0170

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0170. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-64580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device...

PT-2026-68122

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/rxe component. The rxe mmap function removes a rxe mmap info structure from the pending mmaps list and releases the pending lock while the...

Photon OS 5.0: Samba PHSA-2026-5.0-91-0733

An update of the samba package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0733. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-70594

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

CVE-2026-54020

Open WebUI (self-hosted AI platform) contains a DNS rebinding SSRF vulnerability (CVE-2026-54020) affecting pre-0.11.0 behavior. An attacker who controls authoritative DNS for a submitted hostname could have validation return a public address while the connection later resolves to an internal add...

Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages

Summary On standard channels, the message update and delete handlers accepted any caller holding write access on the channel, without checking that the caller wrote the message. Write access is the same grant a member needs in order to post, so every ordinary participant in a shared channel could...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.7 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.21.27 bug fix and security update

Red Hat OpenShift Container Platform release 4.21.27 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

Malicious code in @servicetitan/ld-type-generator (npm)

npm/@servicetitan/ld-type-generator is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/si-switch (npm)

npm/@onereach/si-switch is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11644 Malicious code in @onereach/si-select (npm)

npm/@onereach/si-select is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...