CVE-2026-32243 Discourse: Stored XSS in discourse-ai shared conversations onebox

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an attacker with the ability to create shared AI conversations could inject arbitrary HTML and JavaScript via crafted...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2026-34574

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields expiresAt, createdWith by sending a null value in a PUT request to the...

CVE-2026-33997

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a...

Moderate: libxslt security update

libxslt is a library for transforming XML files into other textual formats including HTML, plain text, and other XML representations of the underlying data using the standard XSLT stylesheet transformation mechanism. Security Fixes: libxslt: Processing web content may disclose sensitive informati...

OPENSUSE-SU-2026:10471-1 tinyproxy-1.11.3-2.1 on GA media

These are all security issues fixed in the tinyproxy-1.11.3-2.1 package on the GA media of openSUSE Tumbleweed...

libpolkit-agent-1-0-127-3.1 on GA media (moderate)

libpolkit-agent-1-0-127-3.1 on GA media Announcement ID: openSUSE-SU-2026:10453-1 Rating: moderate Cross-References: CVE-2025-7519 CVE-2026-4897 CVSS scores: CVE-2025-7519 SUSE : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2025-7519 SUSE : 7.1...

CVE-2026-23356 affecting package kernel for versions less than 6.6.130.1-1

CVE-2026-23356 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-23347 affecting package kernel for versions less than 6.6.130.1-1

CVE-2026-23347 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-23343 affecting package kernel for versions less than 6.6.130.1-1

CVE-2026-23343 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...

ROOT-OS-DEBIAN-11-CVE-2026-25985 CVE-2026-25985 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-25985 in the rootio-imagemagick package for Root:Debian:11. Multiple fixed versions available...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Fedora 44 : python3.12 (2026-9c8d7e5c9a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9c8d7e5c9a advisory. Security fix for CVE-2026-4519. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

strongswan-6.0.5-1.1 on GA media (moderate)

strongswan-6.0.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:10441-1 Rating: moderate Cross-References: CVE-2026-25075 CVSS scores: CVE-2026-25075 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25075 SUSE : 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:...

OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Summary Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Telegram callba...

GHSA-J4C9-W69R-CW33 OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Summary Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State Affected Packages / Versions - Package: openclaw - Affected versions: = 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Telegram callba...

GHSA-8X4M-QW58-3PCX mppx has multiple payment bypass and griefing vulnerabilities

Impact Multiple vulnerabilities were discovered in tempo/charge and tempo/session which allowed for undesirable behaviors, including: - Replaying tempo/charge transaction hashes across push/pull modes, across charge/session endpoints, and via concurrent requests - Performing free tempo/charge...

python311-oci-sdk-2.168.3-1.1 on GA media (moderate)

python311-oci-sdk-2.168.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:10431-1 Rating: moderate Cross-References: CVE-2025-66418 CVSS scores: CVE-2025-66418 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2025-66418 SUSE : 6.9...

CVE-2026-34364

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the categories.json.php endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path no ?user= parameter, user group filtering is...

CVE-2026-33884

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. This has been fixed in 5.73.16...