PT-2026-64135

Summary The execute code tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins . In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining tw...

PT-2026-64142

Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocab size, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this...

Oracle WebLogic Server Multiple Vulnerabilities (July 2026 CPU) (12.2.1.4.0 / 14.1.1.0.0 / 15.1.1.0.0)

The 12.2.1.4.0, 14.1.1.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Easily...

MiracleLinux 9 : php:8.3 (AXSA:2026-1333:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1333:01 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

Fedora 43 : libssh (2026-063caa9112)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-063caa9112 advisory. New upstream security release 2503148 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 43 : perl-YAML-Syck (2026-c8484f1afb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8484f1afb advisory. This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags:...

Oracle WebLogic Server (July 2026 CPU)

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core...

Oracle GoldenGate 19.x < 19.32.0.0.260721 (July 2026 CPU)

The 19.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate component: Service Manager. Easily exploitable vulnerability allows low privileged...

GHSA-7P3P-8QV8-M2VH Eclipse Jetty: HTTP Authority/Host mismatch

Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...

CVE-2026-57214 affecting package rabbitmq-server for versions less than 3.13.7-7

CVE-2026-57214 affecting package rabbitmq-server for versions less than 3.13.7-7. A patched version of the package is available...

EUVD-2026-47564

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types...

CVE-2025-50324

An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component...

WordPress Registrations for the Events Calendar – Event Registration Plugin plugin <= 3.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Registrations for the Events Calendar versions = 3.2...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.13: prometheus3.13-3.13.1-0.3.hum1 aarch64, x8664 prometheus3.13-3.13.1-0.3.hum1.src src Security Fixes: prometheus3.13: CVE-2026-56852...

capstone: Capstone: Denial of Service vulnerability via crafted input

A flaw was found in the Capstone disassembly framework. This vulnerability, a null pointer dereference, can be exploited by a remote attacker. By providing a specially crafted input containing a specific 4-byte sequence during the disassembly of 3DNow! opcodes, the attacker can cause any...

MINI-53MM-J32W-8JW3

Bulletin has no description...

SUSE-SU-2026:22856-1 Security update for jline3

This update for jline3 fixes the following issues: - CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet NEW-ENVIRON variables bsc1269021. - CVE-2026-56741: unauthenticated remote DoS via Unbounded Telnet NAWS Terminal Geometry bsc1270083. Changes for jline3: - Update to...

CVE-2026-46738

creationtimestamp| type| source ---|---|--- 2026-07-22 16:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrargivajr22 2026-07-22 17:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrase5hjxy2m 2026-07-22 17:29:44+00:00| seen|...

SUSE CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

SUSE CVE-2026-56816

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; decodeFrame trusts payLoadLength, allowing an...