EUVD-2026-45270

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions...

CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

CVE-2026-16017

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/toolcron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the...

Oracle Linux 10 : ruby4.0 (ELSA-2026-33540)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33540 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability CVE-2026-42245 Includes core fix plus additional performance optimizations Resolves...

Oracle Linux 10 : python3.14 (ELSA-2026-40856)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40856 advisory. - Security fix for CVE-2026-15308 Resolves: RHEL-193775 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Oracle Linux 10 : python3.14-pip (ELSA-2026-36193)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36193 advisory. 25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion +...

Oracle Linux 10 : krb5 (ELSA-2026-19145)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19145 advisory. 1.21.3-10.0.1 - Fixed race condition in krb5setpassword Orabug: 33609767 1.21.3-10 - Fix NegoEx parsing vulnerabilities CVE-2026-40355, CVE-2026-4035...

Oracle Linux 10 : python3.14 (ELSA-2026-28581)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-28581 advisory. 3.14.5-1 - Update to 3.14.5 Resolves: RHEL-176147 3.14.5rc1-1 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage...

Oracle Linux 10 : wireshark (ELSA-2026-20600)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20600 advisory. - Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory - Resolves: RHEL-173218 - CVE-2026-5405 Heap-base...

Oracle Linux 10 : golang-github-openprinting-ipp-usb (ELSA-2026-35832)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-35832 advisory. - rebuilt with golang-1.26.4-1.el102 to fix CVE-2026-33811, CVE-2026-27145 - rebuilt with golang-1.26.3-4.el102 to fix CVE-2026-32281 Tenable has...

Oracle Linux 10 : perl-Archive-Tar (ELSA-2026-30857)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30857 advisory. - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode Tenable has extracted the preceding description block directly from the...

Oracle Linux 10 : python-urllib3 (ELSA-2026-28000)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-28000 advisory. - Security fix for CVE-2026-44431 - Security fix for CVE-2026-44432 Resolves: RHEL-184817, RHEL-185121 - Security fix for CVE-2025-66471 - Security f...

Oracle Linux 10 : ruby (ELSA-2026-33565)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-33565 advisory. - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in...

Important: Red Hat Security Advisory: python3.14 security update

An update for python3.14 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

CVE-2026-13005

The CVE concerns the MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress. Affected: all versions up to 3.2.10. Vulnerability: Stored Cross-Site Scripting via the intro_message admin setting due to insufficient input sanitization and output escaping. Privileged context: aut...

Oracle Linux 10 : glibc (ELSA-2026-500006)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500006 advisory. - resolv: Check hostname for validity CVE-2026-4438 - resolv: Count records correctly CVE-2026-4437 Tenable has extracted the preceding description...

Fedora 43 : xrdp (2026-bd0a75766f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bd0a75766f advisory. Release notes for xrdp v0.10.6.1 2026/07/06 General announcements This release fixes 10 vulnerabilities and 1 regression introduced by a vulnerabili...

Fedora 44 : xrdp (2026-05c06fa0a8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-05c06fa0a8 advisory. Release notes for xrdp v0.10.6.1 2026/07/06 General announcements This release fixes 10 vulnerabilities and 1 regression introduced by a vulnerabili...

Alibaba Cloud Linux 3 : 0196: compat-openssl10 (ALINUX3-SA-2026:0196)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0196 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-45447: Issue summary: A specially crafted...

CVE-2026-48795

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.prototype still caused lodash .set via @poppinss/utils to create...