Fedora 44 : python-django5 (2026-8a0e918188)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8a0e918188 advisory. Update Django 5 to version 5.2.18 - Fixes CVE-2026-77050 low: Potential denial-of-service vulnerability in getsupportedlanguagevariant - Fixes...

FreeBSD : mod_wsgi -- race condition at process start can leak request context between requests (83f5b20f-4429-4ee1-a764-66a231ed9dab)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 83f5b20f-4429-4ee1-a764-66a231ed9dab advisory. Graham Dumpleton reports: A race condition at process startup could let two threads be handed the same...

Linux Distros Unpatched Vulnerability : CVE-2026-57488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses...

Linux Distros Unpatched Vulnerability : CVE-2026-92528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

PT-2026-116364

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description This issue involves Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. Unauthenticated attackers can force...

PT-2026-116476

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION...

PT-2026-116493

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.83.0 Description An issue exists where unauthenticated attackers can cause a denial of service by exhausting server memory. This is achieved by sending small, highly compressed request bodies using the Content-Encodin...

Linux Distros Unpatched Vulnerability : CVE-2026-103930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches...

SUSE SLES12: libsoup-2_4-1 / libsoup-2_4-1-32bit / libsoup-devel / libsoup-lang / etc (SUSE-SU-2026:4690-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4690-1 advisory. - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547: Header...

Debian dsa-6569 : apache2 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6569 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6569-1 [email protected] https://www.debian.org/securit...

SLiMS 9.8.0 Cross Site Request Forgery

SLiMS version 9.8.0 contains a cross site request forgery issue in loan history maintenance that lets an authenticated administrator with circulation write access trigger destructive GET actions, including truncation of loan history records. https://packetstorm.news/download/236101...

Tandoor Recipes 2.6.9 Server-Side Request Forgery

Tandoor Recipes versions before 2.6.10 contain a server-side request forgery issue in authenticated AI provider actions. The supplied proof of concept authenticates to a target and invokes the affected AI import and step-sort endpoints. https://packetstorm.news/download/236098...

Linux Distros Unpatched Vulnerability : CVE-2026-100351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decode...

PT-2026-116201

Name of the Vulnerable Software and Affected Versions Hippoo Mobile App for WooCommerce versions prior to 1.13.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user in...

CVE-2026-49410

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...

CVE-2026-49410

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...

[SECURITY] [DSA 6569-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6569-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 16, 2026 https://www.debian.org/security/faq -...

haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request

A flaw was found in haproxy. A remote, unauthenticated attacker can trigger a denial of service DoS by sending a specially crafted HTTP/1.1 chunked request. When processing the request, the parser repeatedly re-evaluates the same data without making forward progress, trapping the worker thread in...

DEBIAN-CVE-2026-55862

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and...

DEBIAN-CVE-2026-57488

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, rawtoint in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values...