EUVD-2026-48460

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability

...

CVE-2026-35425

CVE-2026-35425 concerns Azure API Management (APIM) with an “Improper access control” condition that enables a network-exposed remote code execution by an authorized attacker. Affected software is APIM; the root cause is access-control weaknesses that allow code execution over the network. The pr...

SUSE SLES12 Security Update : gawk (SUSE-SU-2026:3211-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3211-1 advisory. This update for gawk fixes the following issue: - CVE-2026-40468: integer overflow in the builtin.c program file bsc1271352. Tenable has extracted the...

PT-2026-64242

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...

PT-2026-64319

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup comm prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

OPENSUSE-SU-2026:11362-1 java-21-openjdk-21.0.12.0-1.1 on GA media

These are all security issues fixed in the java-21-openjdk-21.0.12.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-64267

A critical architectural breakdown targeting enterprise secret storage engines has been disclosed over the last 24 hours. A severe Zero-Day flaw dubbed "VaultSmuggle" tracked as CVE-2026-93401, CVSS 9.8 has been publicly revealed, heavily impacting HashiCorp Vault and OpenBao core clusters. When...

PT-2026-64443

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured base path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base path. A src containing ../ sequences, or an...

OPENSUSE-SU-2026:11363-1 java-25-openjdk-25.0.4.0-1.1 on GA media

These are all security issues fixed in the java-25-openjdk-25.0.4.0-1.1 package on the GA media of openSUSE Tumbleweed...

ROS-20260724-73-0016

The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

ROS-20260724-73-0020

The vulnerability in dotnet10.0 is related to the incorrect implementation of the authentication algorithm. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

Oracle Linux 10 : openssl (ELSA-2026-22314)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-22314 advisory. - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,...

Critical Photon OS Security Update - PHSA-2026-5.0-0929

Updates of 'rubygem-concurrent-ruby' packages of Photon OS have been released...

Fedora 43 : dotnet9.0 (2026-3afd9d89f4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3afd9d89f4 advisory. Update to .NET SDK 9.0.119 and Runtime 9.0.18 Fixes:...

OPENSUSE-SU-2026:11371-1 python313-numpy-2.4.6-1.1 on GA media

These are all security issues fixed in the python313-numpy-2.4.6-1.1 package on the GA media of openSUSE Tumbleweed...

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte...

PT-2026-64259

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The find field function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...

PT-2026-64260

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...

Important: kmod-nvidia-latest-dkms

Issue Overview: NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code...