Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: net: bridge: use a stable FDB dst snapshot in RCU readers CVE-2026-46086 kernel: xfrm: defensively unhash xfrmstate lists in...

Adobe Creative Cloud < 6.10.0.252.3 Multiple Privilege escalation (APSB26-77)

The version of Adobe Creative Cloud installed on the remote Windows host is prior to 6.10.0.252.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-77 advisory. - Creative Cloud Desktop is affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerabilit...

Zoom Workplace < 7.0.5 Vulnerability (ZSB-26012)

The version of Zoom Workplace installed on the remote host is prior to 7.0.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-26012 advisory. - A time-of-check to time-of-use TOCTOU race condition in the installation and uninstallation process of certain Zoom Clients for...

RHEL 8 : kernel-rt update (Important) (RHSA-2026:39082)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39082 advisory. Please update Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory. Note that...

AlmaLinux 8 : kernel-rt update (High) (ALSA-2026:39082)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:39082 advisory. Please update Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note that Nessus has not tested for...

Important: kernel-rt update

Please update...

FacturaScripts: Account takeover of any 2FA-enabled user

Authentication bypass in FacturaScripts: /login?action=two-factor-validation accepts brute-forceable TOTP without password or CSRF protection Summary Core/Controller/Login.php::twoFactorValidationAction accepts an unauthenticated POST containing only fsNick and fsTwoFactorCode. If the TOTP value...

CVE-2026-61458

creationtimestamp| type| source ---|---|--- 2026-07-13 22:50:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrqbq6nf2g...

Malicious code in polymarket-bot-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16019aad4a4500c2df862c6b811c97b0fe227673fd10d921a453924410d17948 On npm install, the package's postinstall hook runs install-check.cjs, which fetches a JSON config from https://jipred.vercel.app/config/clob-math.js...

Symlink Attack

Overview flash-attention is a Flash Attention2 operator on Huawei Ascend 910A. Affected versions of this package are vulnerable to Symlink Attack via the downloadandcopy function in hopper/setup.py when extracting archives without validating symlinks or filtering tar members. An attacker can...

CVE-2026-62239

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the downloadandcopy function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the...

MAL-2026-10508 Malicious code in nodemon-elint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa [email protected] copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a...

MAL-2026-10505 Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

CVE-2026-58408

creationtimestamp| type| source ---|---|--- 2026-07-13 21:48:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkoajc22s2k...

Malicious code in bubblestring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d88c674968228c1d12eff609caca870ebe6d572631e15e2bdde0d0d4b7a320f9 package.json declares a postinstall hook that runs the package's only code file, index.js, on every npm install. index.js is heavily obfuscated...

MAL-2026-10498 Malicious code in eslint-angular-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a6248527167bc121cdf2c1a874adbc9d433dbe4be2aed160e8abb3eb2ca63b package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:8080/ at npm install time,...

MAL-2026-10500 Malicious code in express-bunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68139b9a62e1d546de6ce2e46d5203782dbf54f1af2edbd2b8f509528eb0f000 [email protected] ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP...

Malicious code in express-bunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68139b9a62e1d546de6ce2e46d5203782dbf54f1af2edbd2b8f509528eb0f000 [email protected] ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP...

MAL-2026-10493 Malicious code in insomnia-plugin-poc-m4gester-run (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e package.json declares a postinstall lifecycle hook that runs calc.exe on the installer's machine during npm install. The main entry point exports onl...

Malicious code in insomnia-plugin-poc-m4gester-run (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e package.json declares a postinstall lifecycle hook that runs calc.exe on the installer's machine during npm install. The main entry point exports onl...