Oracle Linux 8 : .NET / 10.0 (ELSA-2026-41900)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41900 advisory. 10.0.110-1.0.1 - Add support for Oracle Linux 10.0.110-1 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192459 Tenable has extract...

MAL-2026-11042 Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

CVE-2026-60549: Missing Authentication for Critical Function

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware component: MFT Runtime Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

PT-2026-62587

Name of the Vulnerable Software and Affected Versions Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 Description A flaw in the MFT Runtime Server component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise the system. Successf...

PT-2026-62122

The NXP LPUART serial driver drivers/serial/uart mcux lpuart.c, when CONFIG UART USE RUNTIME CONFIGURE is enabled, called LPUART Deinit at the start of mcux lpuart configure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcux lpuart...

CVE-2026-60566: Improper Privilege Management

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Runtime Tools. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCent...

GHSA-WP74-JGXH-GV4Q Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service...

GHSA-74JP-VM22-8Q8X Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client System.Net.Mail. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exis...

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass...

GHSA-W7CW-XP7H-6J5J Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service...

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service...

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET runtime cryptography layer CryptoNativeGetX509NameInfo. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability...

EUVD-2026-42300

js-yaml: Quadratic-complexity On^2 DoS via !!omap tag in YAML11SCHEMA...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2025-67726 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2025-67726 Source advisory: OSV:GHSA-JHMP-MQWM-3GQ8...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2025-67725 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2025-67725 Source advisory: OSV:GHSA-C98P-7WGM-6P64...

akto v2.13.9

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet8.0: aspnetcore-runtime-8.0-8.0.29-2.1.hum1 aarch64, x8664 aspnetcore-runtime-dbg-8.0-8.0.29-2.1.hum1 aarch64, x8664 aspnetcore-targeting-pack-8.0-8.0.29-2.1.hum1 aarch64, x8664...

CVE-2026-58414

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.backup recursively collects files using collectBackupFiles. collectBackupFiles uses statSyncfull, which follows symlinks. If data/ contains a symlink to a directory outside the environment roo...

EUVD-2026-46020

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...

EUVD-2026-46018

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling pa...