Oracle Linux 8 : python3.12 (ELSA-2026-2419)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-2419 advisory. 3.12.12-2 - Security fix for CVE-2025-13836 Resolves: RHEL-140993 Tenable has extracted the preceding description block directly from the Oracle Linux security...

PT-2026-7280

Name of the Vulnerable Software and Affected Versions Fortinet FortiAuthenticator versions 6.3 through 6.6.6 Fortinet FortiAuthenticator 6.5 all versions Fortinet FortiAuthenticator 6.4 all versions Description A missing authorization issue in FortiAuthenticator may allow a user with read-only...

RHEL 9 : python3.9 (RHSA-2026:2393)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:2393 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Adobe Substance3D Stager 缓冲区错误漏洞

Substance 3D Stager is the United States of America Ordoby Adobe company launched a dedicated to the 3D scene set, lighting settings and high-quality rendering of professional software. An out-of-bounds write vulnerability exists in Adobe Substance 3D Stager 3.1.6 and earlier versions, which can ...

PT-2026-7474

Name of the Vulnerable Software and Affected Versions DoraCMS versions prior to 3.1 Description The software contains a server-side request forgery SSRF issue in its UEditor remote image fetch functionality. The application takes user-provided URLs and makes server-side HTTP or HTTPS requests...

AMD Processors 安全漏洞

AMD Processors are a series of processors developed by American semiconductor company AMD. There are security vulnerabilities in AMD Processors, which stem from improper isolation of shared resources within the on-chip system. These vulnerabilities may lead to certain integrity losses. The...

Fedora 43 : cef (2026-792b1b7bbd)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-792b1b7bbd advisory. Update to Chromium 144.0.7559.109 CVE-2026-1504: Inappropriate implementation in Background Fetch API Tenable has extracted the preceding description block...

The vulnerabilities of the functions qla2x00_async_login_sp_done(), qla2x00_adisc_sp_done(), and qla2x00_prli_sp_done() in the driver module drivers/scsi/qla2xxx/qla_init.c, which is part of the Linux operating system’s SCSI device support driver. These vulnerabilities allow a hacker to cause a service failure.

The vulnerabilities of the functions qla2x00asyncloginspdone, qla2x00adiscspdone, and qla2x00prlispdone in the driver module drivers/scsi/qla2xxx/qlainit.c are related to code errors. Exploiting these vulnerabilities can allow an attacker to cause a service failure...

Intel® Graphics Advisory

Summary: Potential security vulnerabilities for some Intel® Graphics software may allow escalation of privilege or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-32092 Description: Insecure inherited...

CVE-2025-11468 affecting package python3 for versions less than 3.12.9-8

CVE-2025-11468 affecting package python3 for versions less than 3.12.9-8. A patched version of the package is available...

CVE-2026-25807

CVE-2026-25807 affects ZAI Shell before version 9.0.3, where the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without authentication. A remote attacker can connect to a ZAI-Shell P2P session running in --no-ai mode and send arbitrary system commands. If the host user...

CERTFR-2026-ACT-006

creationtimestamp| type| source ---|---|--- 2026-02-09 14:11:32+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3megmvo2ddj22 2026-02-09 14:11:36+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116041075350640073 2026-02-09 15:34:27+00:00| seen|...

CVE-2026-22922

CVE-2026-22922 affects Apache Airflow versions 3.1.0–3.1.6, where an authorization flaw could allow an authenticated user with custom permissions limited to task access to view task logs without task-log access. The issue has been fixed in Airflow 3.1.7 and later. Practical impact is limited to l...

CVE-2026-24098 Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other Dags they did not have access to. Users are advised to upgrade to 3.1.7 or later, which resolves this issue...

RHSA-2026:2275 Red Hat Security Advisory: python3.9 security update

Bulletin has no description...

RHSA-2026:2233 Red Hat Security Advisory: python3.12 security update

Bulletin has no description...

Moderate: Red Hat Security Advisory: python3.9 security update

An update for python3.9 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

CVE-2026-22904

creationtimestamp| type| source ---|---|--- 2026-02-09 08:18:33+00:00| seen| https://infosec.exchange/users/certvde/statuses/116039686717106372 2026-02-09 08:24:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mefzia5cpd25 2026-02-09 08:24:27+00:00| seen|...

A week in security (February 2 – February 8)

Last week on Malwarebytes Labs: Apple Pay phish uses fake support calls to steal payment details Open the wrong "PDF" and attackers gain remote access to your PC Flock cameras shared license plate data without permission Grok continues producing sexualized images after promised fixes Firefox is...

CVE-2026-2138

A vulnerability was found in Tenda TX9 up to 22.03.02.10multi. Affected is the function sub42D03C of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used...