CLSA-2026-1791806891 TuxCare security update for qs (1 CVE)

TuxCare rebuilt qs to address 1 CVE. Fixed in 6.2.6-tuxcare.2...

CLSA-2026-1791806459 TuxCare security update for nodemailer (11 CVEs)

TuxCare rebuilt nodemailer to address 11 CVEs. Fixed in 9.0.6-tuxcare.1...

CLSA-2026-1791806453 TuxCare security update for nanoid (2 CVEs)

TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.8-tuxcare.1...

CLSA-2026-1791806331 TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3...

CVE-2026-105411 Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance...

CLSA-2026-1791795546 TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.0.12-tuxcare.4...

Important: Red Hat Security Advisory: gd security update

An update for gd is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

CVE-2026-109186: Improperly Controlled Modification of Dynamically-Determined Object Attributes

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenantid and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwri...

PT-2026-110548

Name of the Vulnerable Software and Affected Versions LavaLite CMS versions prior to 10.1.3 Description An authorization bypass allows authenticated low-privileged users to modify other users' accounts, including those of administrators. This is achieved by abusing the isWorkflow check within the...

CVE-2026-109178: Missing Authorization

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP...

gd security update

2.3.3-20.1 - Fix LZW decompression in GIF handling CVE-2026-9672 Resolves: RHEL-259570...

Rocky Linux 8.6 [CIQ] Security Update: libksba / libksba-devel (ciqsa-2026_1603)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261603 advisory. This advisory aggregates security fixes for the libksba SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2022-3515. Tenable has extracted the preceding description...

Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution RCE, server-side template injection SSTI, stored...

Dell System Update < 2.3.0.0 Multiple Vulnerabilities (DSA-2026-324)

According to its self-reported version, the Dell System Update DSU installation on the remote host is prior to 2.3.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2026-324 advisory. - Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitati...

Rocky Linux 9.6 [CIQ] Security Update: WALinuxAgent / WALinuxAgent-cvm / WALinuxAgent-udev (ciqsa-2026_1629)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261629 advisory. This advisory aggregates security fixes for the WALinuxAgent SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2019-0804. Tenable has extracted the preceding descripti...

PT-2026-110601

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The document update endpoint fails to validate file types, unlike the document upload endpoint which correctly blocks executable files. An attacker with administrative permissions can exploit this to upload...

PT-2026-110534

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition versions 17.0 through 17.5 Description An authorization bypass occurs through a user-controlled key, allowing an attacker who possesses tracker administration rights on a single tracker to update or delete fields acro...

Rocky Linux 8.6 [CIQ] Security Update: chkrootkit (ciqsa-2026_1594)

The Rocky Linux 8.6 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20261594 advisory. This advisory aggregates security fixes for the chkrootkit SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2014-0476. Tenable has extracted the preceding description...

CVE-2026-103521: Unrestricted Upload of File with Dangerous Type

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

sh4d0wup

sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Iniciar un servidor de actualizaciones malicioso front Vincular un servidor http/https pero reenviar todo sin modificar infect Manipulación de alto nivel, inyectar comandos adicionales en un...