Out-of-bounds Read

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)

A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...

PT-2026-66513

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description A lack of checks in the UserManager allows for impersonation, which may enable attackers to escalate privileges. Recommendations Upgrade to version 2.12.4 or newer...

PT-2026-66570

Name of the Vulnerable Software and Affected Versions Apache Software Foundation Apache Tika versions 1.8 through 3.3.1 Apache Software Foundation Apache Tika version 4.0.0-alpha-1 Description A relative path traversal issue exists in the ISA-Tab parser. An attacker capable of placing files in a...

PT-2026-66512

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description Debug messages reveal unnecessary information, which could potentially expose sensitive system details. Recommendations Upgrade to version 2.12.4...

PT-2026-66571

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

Fedora 44 : valkey (2026-3d18a65cc4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3d18a65cc4 advisory. Valkey 9.0.5 - Released Tue 21 July 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible...

PT-2026-66564

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema...

fence-agents security update

4.16.0-21.5 - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 Resolves: RHEL-193812...

PT-2026-66517

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.7.0 through 1.11.1 Description Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled...

PT-2026-66503

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description An LDAP injection issue exists where the ActiveDirectoryGroupRealm constructs LDAP search filters without escaping user-controlled input. This allows an authenticated attacker to inject...

PT-2026-66510

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0 Description A Regular Expression Denial of Service ReDoS occurs in the sql parse.py component due to the SQL REGEX used for parsing SQL statements in the sqlparse library integration. The regular...

PT-2026-66504

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

PT-2026-66515

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description Lack of authentication allows the rendering of arbitrary Wiki Markup, which enables an attacker to retrieve sensitive data stored in JSPWiki variables. Recommendations Upgrade to version 2.12...

Debian dsa-6404 : expat - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6404 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6404-1 [email protected] https://www.debian.org/securit...

Oracle Linux 10 : fence-agents (ELSA-2026-48585)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48585 advisory. 4.16.0-21.5 - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 Resolves: RHEL-193812 Tenable has extracted the preceding description block directly...

PT-2026-66502

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.6.0 through 0.12.0 Description A Cross-Site Request Forgery CSRF issue exists due to a default CORS Cross-Origin Resource Sharing configuration that permits cross-origin state-changing requests and accepts text/plain...

PT-2026-66655

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret key base and often credentials for external systems, whic...

Interpretation Conflict

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Interpretation Conflict via the parseCacheControlHeader function in lib/util/cache.js and the cache interceptor. An attacker can cause a shared cached response containing...

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...