Fedora 44 : sngrep (2026-3ff086aa2a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3ff086aa2a advisory. Fixed CVE-2026-90558 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the Squirrel.Mac installer component SQRLInstaller, whe...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.2 Release.

Red Hat OpenShift Dev Spaces 3.30.2 has been released. The 3.30.2 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

ROS-20260929-73-0140

The vulnerability of the spectrumrouter function in the Linux operating system is related to errors during link counter updates. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260929-73-0017

The vulnerability of the netpollcleanup function in the net/core/netpoll.c module of the Linux kernel is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

Fedora 43 : freeipa (2026-5812baee0f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5812baee0f advisory. FreeIPA 4.13.4 security release Upstream release notes: https://www.freeipa.org/release-notes/4-13-4.html Tenable has extracted the preceding description blo...

Oracle Linux 7 : ELSA-2026-62231-0: / libXfont2 (ELSA-2026-622310)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-622310 advisory. - Backport fix for CVE-2026-44950 Orabug: 39960840 - Backport fix for CVE-2026-59679 Orabug: 39960840 Tenable has extracted the preceding description...

Fedora 45 : suricata (2026-9cf326b4f4)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9cf326b4f4 advisory. upstream bugfix/security release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 45 : cinnamon / cinnamon-desktop / cinnamon-session / etc (2026-c4d5a488fe)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c4d5a488fe advisory. - Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but...

CVE-2026-101050

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101050

Heym versions prior to 0.0.53 are vulnerable to an authentication bypass via Telegram webhook endpoints. The root cause is a failure to verify the X-Telegram-Bot-Api-Secret-Token header when the credential_id is absent or the secret_token is empty. This allows remote unauthenticated attackers to ...

EUVD-2026-87970

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-101050: Improper Authentication

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

PT-2026-99557

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.53 Description Insufficient verification of the X-Telegram-Bot-Api-Secret-Token header occurs on Telegram webhook endpoints when the credential id is absent or the secret token is empty. This allows remote...

CVE-2026-100611

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100621 capgo.app Content-Lock Bypass via r2-direct Bundle Mutation

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100613

The capgo.app OTA update platform for Capacitor apps is vulnerable in all versions up to the current release. The transfer_app() database function fails to delete or revalidate records in channel_permission_overrides during an organization transfer. This allows a former member of a source organiz...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

EUVD-2026-87706

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...