cockpit-image-builder security update

94.3-1.0.1 - Switch to old frotend Orabug: 38011073 Orabug: 37856296 Orabug: 37856375 - Replaced additional upstream url Orabug: 37856187 - Replaced upstream urls in documentation with oracle links Orabug: 37856187 94.3-1 - New upstream release 94.2-1 - New upstream release 94.1-1 - Resolve...

Fedora 45 : moby-engine (2026-3a690a88c2)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3a690a88c2 advisory. Automatic update for moby-engine-29.6.2-1.fc45. Changelog Thu Jul 16 2026 Bradley G Smith - 29.6.2-1 - Update to release v29.6.2 - Resolves: rhbz2496437 -...

Fedora 43 : python-tiktoken (2026-8abedbcc4f)

"The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8abedbcc4f advisory. Update to upstream release 0.13.0 Tenable, Inc. The descriptive text and package checks in this plugin were extracted from Fedora Security Advisory...

Qubes OS Security in the Public Record

Qubes OS is a revealing case for security measurement because its architecture makes component boundaries security-relevant. We present a protocol-driven longitudinal analysis of 109 public Qubes Security Bulletins QSBs, 2011--2025, the official Qubes-maintained Xen Security Advisory XSA tracker,...

go-fdo-client and go-fdo-server security update

go-fdo-client 1.0.0-4 - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 1.0.0-3 - Rebuild to fix CVE-2026-32283 go-fdo-server 1.0.1-2 - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 1.0.1-1 - Update to 1.0.1 upstream release - Resolves: RHEL-165475 1.0.0-3 - Rebuild to fix CVE-2026-32283...

aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 on GA media (moderate)

aws-nitro-enclaves-binaryblobs-upstream-1.4.5git0.18a5f6f-1.1 on GA media Announcement ID: openSUSE-SU-2026:11275-1 Rating: moderate Cross-References: CVE-2026-41678 CVE-2026-41898 CVE-2026-42327 CVE-2026-45784 CVSS scores: CVE-2026-41678 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H...

GHSA-38WR-VPC7-2MP4 dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

CVE-2026-56678 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443 and cause 9Router to...

Turning threat intelligence into decisive action with Defender Experts

In this article 1. Upstream: See the campaign before it reaches you 1. In your environment: Follow the threat everywhere it moves 2. See it live at Black Hat USA Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities,...

EUVD-2026-44684

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

CVE-2026-56434

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

CVE-2026-48125

A flaw was found in UAParser.js, a JavaScript library for detecting client information. A remote attacker can exploit this vulnerability by sending a specially crafted Sec-CH-UA-Model header when the application uses the Client Hints API. This can cause excessive CPU usage due to a regular...

CVE-2026-47423

A flaw was found in DOMPurify, a DOM-only cross-site scripting XSS sanitizer. Due to the default allowance of selectedcontent, a remote attacker could craft a malicious payload that, after initial sanitization, could be re-cloned by browsers, leading to the execution of unsanitized markup. This...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to improper trust of loopback requests, where requests forwarded through 127.0.0.1 are incorrectly treated as local and exempt from API key authentication, allowing unauthenticated attackers to access protected /v1 APIs and...

PT-2026-60184

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A use-after-free issue exists in the ngx http ssi module module. This occurs when Server-Side Includes SSI, proxy pass, and proxy bufferin...

openssl security update

3.5.5-2.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.5-2 - Fix CVE-2026-31790 Resolves: RHEL-161574 1:3.5.5-1 - Rebase to OpenSSL 3.5.5 Resolves: RHEL-122599 Resolves: RHEL-141987 Resolves: RHEL-142009 Resolves: RHEL-142022 Resolves:...

PT-2026-60304

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description The Kiro API-key validation endpoint 'POST /api/oauth/kiro/api-key' builds an upstream URL using a user-controlled region value. An authenticated attacker can provide a crafted region to redirect the...

OPENSUSE-SU-2026:11275-1 aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 on GA media

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.4.5git0.18a5f6f-1.1 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 10 : systemd (ELSA-2026-19068)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19068 advisory. 257-23.0.1.el102.1 - Fix detection of Oracle Virtualization or BM envs Orabug: 37531877 - Avoid udevadm warnings when using udev valid configs Orabug: 3750319...

NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...