CVE-2026-83539: Apache Software Foundation Apache Wicket: Improper neutralization of input during web page generation in Apache Wicket

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escap...

PT-2026-135046

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.19.0 Apache Wicket versions 9.0.0 through 9.24.0 Apache Wicket versions 10.0.0 through 10.11.0 Description Improper neutralization of input during web page generation occurs when the...

PT-2026-135051

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

CVE-2026-120274: beecue FastBee: A vulnerability was identified in beecue FastBee up to 2.1.0

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

PT-2026-135044

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.18.0 through 8.19.0 Apache Wicket versions 9.23.0 through 9.24.0 Apache Wicket versions 10.9.0 through 10.11.0 Description Session fixation exists in the role-based security module. The signInString, String method in t...

PT-2026-135043

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

PT-2026-135054

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

CentOS Linux 7 [TuxCare] Security Update: sudo / sudo-devel (CENTOS7:CLSA-2026:1793183073)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793183073 advisory. - A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z...

Linux Distros Unpatched Vulnerability : CVE-2026-104843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way tha...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_92869)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202692869 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

PT-2026-135037

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

openSUSE 16: stgit / stgit-bash-completion / stgit-emacs / stgit-fish-completion / etc (openSUSE-SU-2026:22204-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22204-1 advisory. Changes in stgit: - Update to version 2.7.0: Allow unambiguous command shorthands, opt-in with stgit.infer-commands. Accept git approxidate...

SUSE SLED15: flatpak / flatpak-devel / flatpak-remote-flathub / etc (SUSE-SU-2026:4944-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4944-1 advisory. - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and wri...

Fedora 43 : ruby (2026-8e3e7af1cb)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8e3e7af1cb advisory. New version 3.4.12 is released. This new rpm contains several bug fixes in Onigumo regular expression compilation. Tenable has extracted the preceding...

FreeBSD : uriparser -- Denial of Service through Unbound Recursion (65abbad5-da78-11f0-b6d5-843a4b343614)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 65abbad5-da78-11f0-b6d5-843a4b343614 advisory. The URIparser project reports: uriparser through 0.9.9 allows unbounded recursion and stack consumption...

openSUSE 16 Security Update : python-Brotli (openSUSE-SU-2026:22183-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22183-1 advisory. - CVE-2025-6176: denial of service DoS due to a flaw in its brotli decompression bsc1252945. - CVE-2026-111497: Brotli decoder out-of-bounds wri...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2026_89757)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689757 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

Linux Distros Unpatched Vulnerability : CVE-2026-120245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrastdecodeframe that leaks heap memory when decoding truncated 1-bit and...

Rocky Linux 8 [CIQ] Security Update: hplip / hplip-common / hplip-debuginfo / hplip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_82295)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202682295 advisory. hplip: potential memory buffer overflow CVE-2020-6923 hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-120208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in uncdecodermixedinterleave::processTile that allows attackers to write out of...