SiYuan <= v3.6.1 - Bookmark Data Disclosure

SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service. id:...

RClone RC - Command Injection

Rclone = 1.48.0 and = 1.48.0 and 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment...

Rockwell Automation Micro850/870 Dependency on Vulnerable Third-Party Component (CVE-2025-13823)

A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers. This issue occurs when the controllers receive multiple malformed packets, causing the controller to enter a recoverable fault fault code 0xFE60. To recover the controller, the fault must be cleared. This plugi...

CVE-2026-66053

Technical details are not publicly available in the provided documents. Monitor for updates from official advisories to learn affected versions, exploitability, and remediation.

[SECURITY] [DLA 4700-1] linux-6.1 security update

Debian LTS Advisory DLA-4700-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings July 26, 2026 https://wiki.debian.org/LTS Package : linux-6.1 Version : 6.1.177-1deb11u1 CVE ID : CVE-2025-23131 CVE-2026-23272 CVE-2026-23278 CVE-2026-23302 CVE-2026-31451 CVE-2026-46252...

GHSA-8R6M-32JQ-JX6Q fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

Medium: golang-github-burntsushi-toml

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

openSUSE 16 Security Update : lux (openSUSE-SU-2026:21367-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21367-1 advisory. Changes in lux: - CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Issues when parsing HTML files bsc1267110 -...

PYSEC-2026-3040 python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

Summary parseform did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. Details...

CVE-2026-46680 affecting package moby-containerd-cc for versions less than 1.7.7-15

CVE-2026-46680 affecting package moby-containerd-cc for versions less than 1.7.7-15. A patched version of the package is available...

Fedora 44 : acl (2026-6b9a652463)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b9a652463 advisory. rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370 Resolves: CVE-2026-54369 Resolves: CVE-2026-54370 Tenable has extracted the preceding...

Fedora 44 : prometheus (2026-01a1840582)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-01a1840582 advisory. Update to 3.13.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

PT-2026-57342

Name of the Vulnerable Software and Affected Versions RoundCube versions prior to 1.7 Description A stored cross-site scripting XSS flaw exists where an unescaped attachment MIME type is displayed on the attachment-validation warning page. An attacker can craft a malicious MIME type string that,...

SUSE-SU-2026:22557-1 Security update for haproxy

This update for haproxy fixes the following issues - Update to version 3.2.21+git0.dbe43be37 - CVE-2026-55203: integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers bsc1268557. - CVE-2026-55204: null pointer dereference...

PT-2026-55924

Name of the Vulnerable Software and Affected Versions ModSecurity versions prior to 3.0.16 Description The multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS POST. This occurs becau...

PT-2026-54860

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.9 Craft CMS versions 5.0.0-RC1 through 5.9.9 Description Control panel users with the utility:system-messages permission can embed a file-reading payload into system email templates because the dataUrl...

PT-2026-54686

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.46 Description A use after free issue in Skia, a graphics library, allows a remote attacker to potentially perform a sandbox escape by using a crafted HTML page. A use after free occurs when a program...

Fedora 44 : rclone (2026-6145ae14ca)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6145ae14ca advisory. Update to 1.74.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 43 : moby-engine (2026-0feb6e4967)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0feb6e4967 advisory. - Update to release v29.6.0 - Resolves: rhbz2490590 - Resolves CVE-2026-39828: rhbz2489945 - Resolves CVE-2026-39829: rhbz2490099 - Resolves...

OPENSUSE-SU-2026:21011-1 Security update for 389-ds

This update for 389-ds fixes the following issue - CVE-2026-9064: unbounded LDAP controls count in getldapmessagecontrolsext can lead to amplified CPU time and heap allocation and a denial of service bsc1265898. Changes for 389-ds: - Update to version 3.0.6git337.647f49042: Issue 7541 -...