Fedora 43 : xorg-x11-server-Xwayland (2026-6a00d3109f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6a00d3109f advisory. Update to xwayland 24.1.13, fixes for: CVE-2026-55999, CVE-2026-56000 Tenable has extracted the preceding description block directly from the Fedora...

Fedora 43 : python-tornado (2026-23656e6d2f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-23656e6d2f advisory. Update to 6.5.7 - CVE-2026-35536 rhbz2457335, CVE-2026-31958 rhbz2451660 Tenable has extracted the preceding description block directly from the...

OPENSUSE-SU-2026:11260-1 patch-2.8-3.1 on GA media

These are all security issues fixed in the patch-2.8-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-57577

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.8.1 Description An improper authorization issue exists in the API component within the Setting::saveSetting function. This flaw allows a remote attacker to manipulate settings due to insufficient authorization...

Fedora 43 : acl (2026-67504c329b)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-67504c329b advisory. rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370 Resolves: CVE-2026-54369 Resolves: CVE-2026-54370 Tenable has extracted the preceding...

CVE-2026-60090

creationtimestamp| type| source ---|---|--- 2026-07-11 14:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqeulm7xao2h 2026-07-11 14:45:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqevnii7zw2d 2026-07-11 15:01:00+00:00| seen|...

MINI-RMQ5-P3M4-693R

Bulletin has no description...

CVE-2026-57828

The CVE-2026-57828 entry concerns the Joomla extension Phoca Downloads (Phoca.cz) with an authenticated arbitrary file upload vulnerability in the RSFiles component prior to 6.1.3. The issue allows registered users to upload executable files, enabling full remote code execution (RCE). The provide...

MINI-WGM3-Q55P-3GFX

Bulletin has no description...

CVE-2026-4661

creationtimestamp| type| source ---|---|--- 2026-07-11 07:38:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5rxtqrn2e 2026-07-11 07:50:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqe6hic4ql2k 2026-07-11 08:00:38+00:00| seen|...

CVE-2026-11898

creationtimestamp| type| source ---|---|--- 2026-07-11 07:30:49+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqe5f2ulhx2s 2026-07-11 07:32:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqe5i3a4zn27 2026-07-11 07:34:08+00:00| seen|...

CVE-2026-11591 Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters

The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

CVE-2026-11901

Affected software: WordPress WP Hotel Booking plugin (versions ≤ 2.3.1). Vulnerability: Insufficient Verification of Data Authenticity in the PayPal IPN handler (web_hook_process_paypal_standard). The IPN validation endpoint can be chosen from attacker-controlled test_ipn, permitting force-upgrad...

[SECURITY] Fedora 44 Update: tmux-3.7b-2.fc44

tmux is a "terminal multiplexer." It enables a number of terminals or windows to be accessed and controlled from a single terminal. tmux is intended to be a simple, modern, BSD-licensed alternative to programs such as GNU Screen...

[SECURITY] Fedora 43 Update: openssh-10.0p1-10.fc43

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

CVE-2026-44383

creationtimestamp| type| source ---|---|--- 2026-07-11 00:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqdeapdzdx2d 2026-07-11 00:26:27+00:00| seen| https://bsky.app/profile/potato.software/post/3mqdfo7uggq2t 2026-07-11 00:31:47+00:00| seen|...

CVE-2026-42952

creationtimestamp| type| source ---|---|--- 2026-07-11 00:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqdeaiktsn2j 2026-07-11 00:00:54+00:00| seen| https://bsky.app/profile/potato.software/post/3mqdeajkg5e2x 2026-07-11 00:26:47+00:00| seen|...

CVE-2026-14480

CVE-2026-14480 affects OpenPLC Runtime v3. An authenticated user can write arbitrary files via the legacy web UI program-upload workflow by storing a attacker-controlled filename (prog_file) that is later used as the destination path. Python os.path.join() honors absolute paths, enabling writes a...

CVE-2026-55213

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.14: python3.14-3.14.6-1.4.hum1 aarch64, x8664 python3.14-debug-3.14.6-1.4.hum1 aarch64, x8664 python3.14-devel-3.14.6-1.4.hum1 aarch64, x8664 python3.14-freethreading-3.14.6-1.4.hum1...