Fedora 44 : dotnet10.0 (2026-f738966fc9)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f738966fc9 advisory. Update to .NET SDK 10.0.110 and Runtime 10.0.10 Fixes:...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:21432-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21432-1 advisory. Changes in gh: - CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version...

openSUSE 16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (openSUSE-SU-2026:21406-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21406-1 advisory. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate bsc1270542. -...

openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21436-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21436-1 advisory. Changes in rclone: - Update to version 1.74.4 boo1267192: Version v1.74.4 gui: update embedded release to 1.1.10 local: stop --links symlinks...

Fedora 43 : mbedtls (2026-0bb141710c)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0bb141710c advisory. - Update to 3.6.7 - Fixes CVE-2026-25832, CVE-2026-35336, CVE-2026-49300, CVE-2026-50579, CVE-2026-50580, CVE-2026-50581, CVE-2026-50583,...

PT-2026-64632

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter ebtables component, the update counters and compat update counters functions forward a user-supplied 32-byte table name to find table lock without NUL-termination. When ...

Photon OS 5.0: Rubygem PHSA-2026-5.0-0929

An update of the rubygem package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0929. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-64371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, wher...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the updateUser process of the API endpoint, which fails to enforce proper authorization checks for editing superuser accounts and changing user passwords. An attacker can gain full administrative access by sendi...

GHSA-47W6-GWP4-W6VC vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No...

GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to Admin.Read but not Admin.Write can call POST /api/v4/admin/policy/oauth/signin and update OneDrive storage policy credentials. The route is inside the admin group...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-bin-22.23.1-2.3.hum1 noarch nodejs22-devel-22.23.1-2.3.hum1 aarch64, x8664 nodejs22-docs-22.23.1-2.3.hum1 noarch...

GO-2026-5525 GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) in github.com/osrg/gobgp

GoBGP has a panic in AdjRib.Update via malformed BGP Update message Nil Pointer Dereference in github.com/osrg/gobgp...

GO-2026-5971 GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function in github.com/osrg/gobgp

GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function in github.com/osrg/gobgp...

GHSA-GMFW-G93R-VG53 Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs26: nodejs26-26.5.0-1.4.hum1 aarch64, x8664 nodejs26-bin-26.5.0-1.4.hum1 noarch nodejs26-devel-26.5.0-1.4.hum1 aarch64, x8664 nodejs26-docs-26.5.0-1.4.hum1 noarch...

CVE-2026-15966

creationtimestamp| type| source ---|---|--- 2026-07-24 16:45:08+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-6 2026-07-31 12:40:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrwxywh52x23...

CVE-2026-15968

creationtimestamp| type| source ---|---|--- 2026-07-24 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-6 2026-07-31 12:40:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrwxywh52x23...

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

Impact What kind of vulnerability is it? Who is impacted? Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOnefilter, req.body, can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype. Example: javascript...