Statamic: Account takeover via OAuth email matching without email-verification check

Impact When OAuth login is enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user — potentially including a super admin — without their password. Exploitation requires OAuth to be explicitly enabled with such a...

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...

EUVD-2026-54230

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Summary There is a high severity vulnerability in Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares. The fix for CVE-2026-33433 stripped canonical-cased spoofed identity headers e.g. X-Auth-User before writing Traefik's own value, but did not account for underscore-variant header names...

EUVD-2026-53855

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...

EUVD-2026-53699

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classifycommandrisk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of...

RLSA-2026:50142 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

RLSA-2026:49851 Moderate: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: Rocky Linux8.10 - KVM: s390: Limit...

EulerOS 2.0 SP13 : bzip2 (EulerOS-SA-2026-3009)

According to the versions of the bzip2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : bzip2 contains an offbyone error in the bzip2recover utility. When processing a specially crafted file, the application performs an outofbounds wri...

ROOT-APP-NPM-CVE-2025-57810 CVE-2025-57810 in jspdf - Patched by Root

Root has patched CVE-2025-57810 in the jspdf package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-33230 CVE-2026-33230 in nltk - Patched by Root

Root has patched CVE-2026-33230 in the nltk package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1785917668 TuxCare security update for 36 packages (3 CVEs)

TuxCare rebuilt 36 packages to address 3 CVEs. Fixed in 7.0.109-tuxcare.4...

CVE-2026-64566

Consolidated details show CVE-2026-64566 affects the Linux kernel iptfs module. Root cause: when iptfs_skb_add_frags() copies frag references, it increments page refs without propagating SKBFL_SHARED_FRAG to the destination SKB, unlike other frag-transfer helpers. Consequence: if source SKB has s...

ROOT-APP-PYPI-CVE-2026-33936 CVE-2026-33936 in ecdsa - Patched by Root

Root has patched CVE-2026-33936 in the ecdsa package for Root:PyPI. Multiple fixed versions available...

Photon OS 5.0: Emacs PHSA-2023-5.0-91-0048

An update of the emacs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0048. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Ruby PHSA-2024-5.0-91-0236

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0236. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: E2Fsprogs PHSA-2023-5.0-91-0165

An update of the e2fsprogs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0165. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Abseil PHSA-2025-5.0-91-0656

An update of the abseil package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0656. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Grub2 PHSA-2026-5.0-90-0857

An update of the grub2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0857. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Mysql PHSA-2023-5.0-91-0056

An update of the mysql package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0056. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...