SUSE SLES16 Security Update : ca-certificates-mozilla (SUSE-SU-2026:24361-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24361-1 advisory. This update for ca-certificates-mozilla fixes the following issue: Updated to 2.92 state bsc1286261 Removed: - emSign ECC Root CA - C3 -...

Juniper Junos OS Multiple Vulnerabilities (JSA112188)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA112188 advisory. - An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to...

PLANET IGS-5225-8P2T4S Active Debug Code (CVE-2026-81943)

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying...

Linux Distros Unpatched Vulnerability : CVE-2026-115372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.createoptions through volume update, copy,...

PLANET IGS-5225-8P2T4S OS Command Injection (CVE-2026-81942)

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command injection vulnerability in the web server. User-supplied input is passed to system without sufficient filtering, allowing a remote authenticated attacker to...

RockyLinux 8 : flatpak (RLSA-2026:89859)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89859 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary...

RockyLinux 10 : flatpak (RLSA-2026:89849)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89849 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a sanitization bypass in scrubTemplateExpressions when SAFEFORTEMPLATES is enabled alongside a DOM-returning mode. The post-wal...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a sanitization bypass in scrubTemplateExpressions when SAFEFORTEMPLATES is enabled alongside a DOM-returning mode. The post-walk safety net...

CVE-2026-116804

The DOMPurify library (versions 3.4.4 before 3.4.17 ) contains a SAFE_FOR_TEMPLATES bypass. When using RETURN_DOM , RETURN_DOM_FRAGMENT , or IN_PLACE modes, attackers can preserve template expressions within attached shadow roots by splitting them across text nodes separated by disallowed element...

CVE-2026-116804 DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

CVE-2026-116804 DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

CVE-2026-86936

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

CVE-2026-86939

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker with root privileges may be able to access protected user data...

CVE-2026-86896

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to gain root privileges...

CVE-2026-65392

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7. An app with root privileges may be able to access private information...

CVE-2026-65373

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to gain root privileges...

CVE-2026-113900

A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

CVE-2026-112668

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

CVE-2026-112545

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...