Vulnerability of NVIDIA Display Driver and Guest Driver: NVIDIA’s virtual graphics processor drivers allow attackers to escalate their privileges and execute arbitrary code.

The vulnerability of NVIDIA Display Driver and Guest Driver, which are used for NVIDIA’s virtual graphics processors, is related to improper resolution saving. Exploiting this vulnerability can allow attackers to increase their privileges and execute arbitrary code...

RockyLinux 9 : runc (RLSA-2026:70191)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:70191 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 Tenable has extracted the preceding description...

WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution

Description WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on th...

Linux Distros Unpatched Vulnerability : CVE-2026-95275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged pa...

Linux Distros Unpatched Vulnerability : CVE-2026-95334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in WebProtect. CVE-2026-95334 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 809...

RHEL 9 : runc (RHSA-2026:70191)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:70191 advisory. The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: net/url:...

PT-2026-97204

Name of the Vulnerable Software and Affected Versions Apache BuildStream versions prior to 2.8.1 Description An improper link resolution issue exists in the tar source plugin when running on Python versions prior to 3.12. This allows malicious source tarballs to write files on the host system wit...

Exploit for CVE-2026-87902

wp-ghsa-7hp8-lab Outillage de détection et banc d'essai repro...

CVE-2026-77605

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-77605 Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd...

CVE-2026-93375

A flaw was found in Google Chrome. This vulnerability, located in the Tracing component, involves incorrect reference resolution. A local attacker could exploit this flaw by using a local program, potentially leading to arbitrary code execution outside the browser's security sandbox...

SUSE-SU-2026:4286-1 Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278681 - CVE-2026-78662:...

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

Summary The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and...

EUVD-2026-84031

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509...

GHSA-798P-78G2-V556 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

Summary The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and...

SUSE-SU-2026:4283-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. - CVE-2026-59946:...

Logic flaw in Brocade SANnav Java cache key handling object comparison handling

A logic flaw in Brocade SANnav Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

VulnCheck KEV: CVE-2026-87902

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution...

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and cloud...