PT-2026-66488

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes...

PT-2026-66590

Name of the Vulnerable Software and Affected Versions dnsmgr versions prior to 2.16 Description A local attacker can execute arbitrary code through the ping function located in the CheckUils.php file. Recommendations Update dnsmgr to version 2.16 or later. As a temporary workaround, restrict acce...

PT-2026-66445

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory,...

PT-2026-66634

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GOOSE subscriber component fails to properly validate the UTC timestamp field in unauthenticated IEC 61850 GOOSE EtherType 0x88B8 Layer-2 multicast messages...

Linux Distros Unpatched Vulnerability : CVE-2026-56847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to...

RockyLinux 8 : perl:5.32 (RLSA-2026:48225)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:48225 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding description...

PT-2026-66514

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description The software is susceptible to JSON Hijacking, a technique where an attacker steals sensitive data from a JSON response. This flaw subsequently leads to Cross-Site Request Forgery CSRF, which...

CVE-2026-35847

The dnsmgr software (versions v.2.15 and before ) contains a vulnerability that allows a local attacker to execute arbitrary code . The root cause is identified as the ping() function located within the CheckUils.php file. Impacted users are advised to update to version 2.16 or later . As a tempo...

CVE-2026-35847

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file...

PT-2026-66407

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the Permission Model enforcement allows the trace events.createTracing.enable function to write trace logs outside the boundaries defined by the...

PT-2026-66439

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Description A flaw in the HTTP/2 handling allows retained header blocks to evade maxSessionMemory, which can lead to remote memory exhaustion. Memory exhaustion occurs when a system consumes all...

PT-2026-66408

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the Node.js HTTPS Agent connection reuse mechanism can lead to PFX object-array key collisions. This issue allows mutual TLS mTLS client identities to be...

PT-2026-66513

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description A lack of checks in the UserManager allows for impersonation, which may enable attackers to escalate privileges. Recommendations Upgrade to version 2.12.4 or newer...

Fedora 44 : proftpd (2026-2994824419)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2994824419 advisory. This update adds a new module, modprocfs, which is enabled by default. It addressses CVE-2026-35025 ACL bypass via /proc/self/root path prefix, by disallowin...

Security update for s2n (moderate)

openSUSE security update: security update for s2n ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21474-1 Rating: moderate References: bsc1272352 Cross-References: CVE-2026-16317 CVE-2026-16318 CVSS scores: CVE-2026-16317 SUSE : 6.5...

CVE-2026-62343 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issu...

nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.23.2-2.3.hum1 aarch64, x8664 nodejs22-bin-22.23.2-2.3.hum1 noarch nodejs22-devel-22.23.2-2.3.hum1 aarch64, x8664 nodejs22-docs-22.23.2-2.3.hum1 noarch...

CVE-2026-67437

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...