Fedora 43 : rust-rustls-webpki / rust-webpki-root-certs / rust-webpki-roots (2026-1ffbf97eba)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-1ffbf97eba advisory. - Update the rustls-webpki crate to version 0.103.16. - Update the webpki-roots and webpki-root-certs crates to version 1.0.10. This addresses security...

OpenBao log information leakage vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a log information leakage vulnerability. This occurs when request audit logs are successfully recorded but response audit logs fail to be recorded; as a result, no response audit entries are written for unauthenticated...

PT-2026-121683

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

KiloView E3 firmware command injection vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a command injection vulnerability. This vulnerability arises because network management services fail to validate the names of network interfaces before passing them to shell commands; as a result, authenticated web users with network...

TP-Link Tapo C320WS connectAp Unauthenticated Privilege Escalation

The vulnerability of the connectAp component in TP-Link Tapo C320WS microprogrammable software-based cameras lies in the fact that the operation data is written outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information,...

SUSE SLES11 Security Update : openssl-certs (SUSE-SU-2026:4820-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4820-1 advisory. This update for openssl-certs fixes the following issue: Updated to 2.92 state bsc1286261 CVE-2026-114406 bsc1287180 Removed: - emSign ECC Root CA - C3...

PT-2026-121556

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entrie...

PT-2026-121670

Name of the Vulnerable Software and Affected Versions Kiloview E3 NDI encoder affected versions not specified Description The network management service fails to sanitize a field used during the configuration of static routes via the web management API. An authenticated user with permissions to...

Fedora 43 : ca-certificates (2026-3ee4dad1c6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3ee4dad1c6 advisory. Update ca-certificates to ca-certificates-2026.2.92v9.0.319-2.fc43 Remove emSign Root CS CA - G3 Additional code signing certificate that sign 2 of the...

SUSE SLES12 Security Update : ca-certificates-mozilla (SUSE-SU-2026:4821-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4821-1 advisory. Updated to 2.92 state bsc1286261 Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1 Updated to 2.90 state...

LXC Incus command injection vulnerability

Versions LXC Incus from 7.3.0 through 7.5.0 contain a command injection vulnerability. This vulnerability stems from the ability to bypass project restrictions; restricted project users can set block.createoptions via volume updates, copying, and moving operations. This allows them to trigger...

MAL-2026-18129 Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...

MAL-2026-18127 Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

Malicious code in @sudobility/indexer_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...

Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

MAL-2026-18128 Malicious code in @sudobility/shaperouter_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...

CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

The system certificate authority CA store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle...

CVE-2026-114406

The system certificate authority (CA) store in Red Hat products , distributed via ca-certificates RPM packages , contains multiple root CA certificates that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority . A man-in-the-middle attacker could ...

CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

The system certificate authority CA store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle...