CVE-2026-12490

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port and not the tls-auth-port or over over TCP over the regular...

CVE-2026-54512 vulnerabilities

Vulnerabilities for packages: hono, apache-camel-karavan-devmode, kserve-modelmesh, apache-tomee, cassandra-fips, geoserver, wazuh-indexer, spark, kayenta, kayenta-fips, reposilite, conductor-fips, ruby4.0-jrjackson, pinot-fips, localstack, logstash-fips, tez, spark-kubernetes-operator-fips,...

GHSA-RCQC-6CW3-H962 vulnerabilities

Vulnerabilities for packages: keycloak-fips, solr, apache-camel-karavan-devmode, apache-tika-fips, apache-tomee, cassandra-fips, jenkins, kafka, management-api-for-apache-cassandra-5.0, opensearch, geoserver, apache-hop, strimzi-kafka-operator, confluent-kafka, kafbat-ui-fips, dependency-track,...

CVE-2026-54514 vulnerabilities

Vulnerabilities for packages: hono, apache-camel-karavan-devmode, kserve-modelmesh, apache-tomee, cassandra-fips, geoserver, wazuh-indexer, spark, kayenta, kayenta-fips, reposilite, conductor-fips, ruby4.0-jrjackson, pinot-fips, localstack, logstash-fips, tez, spark-kubernetes-operator-fips,...

CVE-2026-54513 vulnerabilities

Vulnerabilities for packages: hono, apache-camel-karavan-devmode, kserve-modelmesh, apache-tomee, cassandra-fips, geoserver, wazuh-indexer, spark, kayenta, kayenta-fips, reposilite, conductor-fips, ruby4.0-jrjackson, pinot-fips, localstack, logstash-fips, tez, spark-kubernetes-operator-fips,...

GHSA-RMJ7-2VXQ-3G9F vulnerabilities

Vulnerabilities for packages: hono, apache-camel-karavan-devmode, kserve-modelmesh, apache-tomee, cassandra-fips, geoserver, wazuh-indexer, spark, kayenta, kayenta-fips, reposilite, conductor-fips, ruby4.0-jrjackson, pinot-fips, localstack, logstash-fips, tez, spark-kubernetes-operator-fips,...

CVE-2026-54516 vulnerabilities

Vulnerabilities for packages: keycloak-fips, solr, apache-camel-karavan-devmode, apache-tika-fips, apache-tomee, cassandra-fips, jenkins, kafka, management-api-for-apache-cassandra-5.0, opensearch, geoserver, apache-hop, strimzi-kafka-operator, confluent-kafka, kafbat-ui-fips, dependency-track,...

CVE-2026-54517 vulnerabilities

Vulnerabilities for packages: keycloak-fips, solr, apache-camel-karavan-devmode, apache-tika-fips, apache-tomee, cassandra-fips, jenkins, kafka, management-api-for-apache-cassandra-5.0, opensearch, geoserver, apache-hop, strimzi-kafka-operator, confluent-kafka, kafbat-ui-fips, dependency-track,...

GHSA-9FXM-VC8V-HJ55 vulnerabilities

Vulnerabilities for packages: keycloak-fips, solr, apache-camel-karavan-devmode, apache-tika-fips, apache-tomee, cassandra-fips, jenkins, kafka, management-api-for-apache-cassandra-5.0, opensearch, geoserver, apache-hop, strimzi-kafka-operator, confluent-kafka, kafbat-ui-fips, dependency-track,...

Grafana 3.0.1-7.0.1 - Server-Side Request Forgery

Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which can lead to remote code execution. Any unauthenticated user/client can make Grafana send HTTP requests to any URL and return its result. This can be used to gain information about the network...

PT-2026-52545

Name of the Vulnerable Software and Affected Versions NewsBlur versions prior to 14.5.0 Description Authenticated users can perform server-side request forgery SSRF via the 'add url' endpoint. This occurs because the application fails to filter private IP addresses, allowing arbitrary server...

Linux Distros Unpatched Vulnerability : CVE-2026-53072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock...

UBUNTU-CVE-2026-12490

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port and not the tls-auth-port or over over TCP over the regular...

PT-2026-52584

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description There are certificate policy and RFC 8446 compliance concerns due to the continued acceptance of SHA-1 and MD5 hashing algorithms during certificate processing...

PT-2026-52594

Name of the Vulnerable Software and Affected Versions Apicurio Registry affected versions not specified Description A flaw exists where the WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, a user with...

PT-2026-52353

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs during split 6 GHz scanning when the cfg80211 scan function fails. The rdev-int scan req variable is leaked because the cleanup process in cfg80211 scan done is...

PT-2026-52368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the OP-TEE driver of the Linux kernel. This occurs when a client task terminates while a supplicant is still processing its request. Because the client m...

Oracle Linux 9 : tomcat (ELSA-2026-26323)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26323 advisory. - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 - Resolves: Tomcat: Cloud membership for clustering...

CVE-2026-55454

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by...

CVE-2026-49979

Appsmith prior to version 1.99 exposes a vulnerability in the POST /api/v1/admin/send-test-email endpoint. An attacker can supply smtpHost and smtpPort values to establish a raw JavaMail TCP connection, bypassing WebClientUtils.IP_CHECK_FILTER (which only applies to Spring WebClient HTTP requests...