Fedora 45 : vaultwarden (2026-b986dd11b9)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b986dd11b9 advisory. Automatic update for vaultwarden-1.37.1-1.fc45. Changelog Mon Aug 3 2026 Jonathan Wright - 1.37.1-1 - update to 1.37.1 rhbz2510094 - Fix CVE-2026-31812...

RHEL 10 : osbuild-composer (RHSA-2026:49526)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49526 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

thunderbird security update

140.13.0-1.0.1 - Add Oracle prefs 140.13.0-1 - Update to 140.13.0 ESR...

ALSA-2026:49667 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

openSUSE 16 Security Update : perl-Date-Manip (openSUSE-SU-2026:21510-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21510-1 advisory. Changes in perl-Date-Manip: - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range test...

MiracleLinux 9 : nginx:1.24 (AXSA:2026-1411:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1411:01 advisory. nginx: ngxhttprewritemodule: code execution and denial of service CVE-2026-9256 Tenable has extracted the preceding description block directly from the...

Oracle Linux 10 : p11-kit (ELSA-2026-49668)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49668 advisory. 0.26.4-1 - Rebase to 0.26.4 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

Fedora 45 : docker-buildkit (2026-26c0a0ee30)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-26c0a0ee30 advisory. Automatic update for docker-buildkit-0.32.1-1.fc45. Changelog Mon Aug 3 2026 Bradley G Smith - 0.32.1-1 - Update to release v0.32.1 - Upstream fixes...

ALSA-2026:49511 Important: frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fixes: frr: FRRouting: Denial of Service via crafted BGP UPDATE message CVE-2026-37460 For more details about the security issues,...

[SECURITY] [DSA 6410-1] libssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6410-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 02, 2026 https://www.debian.org/security/faq -...

CVE-2026-18573

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

EUVD-2026-51947

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest...

CVE-2026-16292 Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest...

CVE-2026-16292

CVE-2026-16292 affects the Frontend File Manager Plugin for WordPress up to version 23.6. The vulnerability arises because one file-metadata update action does not validate a nonce, enabling CSRF to modify the metadata of a logged-in user’s uploaded file, which can be leveraged to download that f...

EUVD-2026-51939

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

EUVD-2026-51938

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...

EUVD-2026-51927

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

CVE-2026-18573 Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...

CVE-2026-18573

Summary: The CVE-2026-18573 affects the keycloak-services component of Keycloak. The root cause is improper evaluation of client state during a realm update, allowing a user with client management permissions to bypass client policies by first creating a public client and then upgrading it to a c...

CVE-2026-18573 Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...