AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory. - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable...

PT-2026-120656

Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain...

PT-2026-120897

============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImaging LibTiffEncoderNew Commit: a707c6b21c313880d0771e54965d142dd42358b6...

PT-2026-120671

Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...

PT-2026-120670

Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to change mail routing and domain configuration beyond those domains on a multi-tenant server. A doma...

PT-2026-120610

WarehousePG WHPG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability CWE-862 in gp add coordinator standby. The function is named gp add master standby in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove...

Wireshark 1.10.x < 1.10.1 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.10.1 advisory. - The IsDFPFrame function in plugins/profinet/packet-pn-rt.c in the PROFINET Real-Time dissector in...

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245

This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This...

RHEL 9 : sudo (RHSA-2026:86634)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86634 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory. - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana (UTSA-2026-142362)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142362 advisory. Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link...

SUSE SLES15 Security Update : grafana, system-user-grafana (SUSE-SU-2026:4600-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4600-1 advisory. - Update to version 12.4.10: Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials...

PT-2026-120159

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the...

Parasoft Continuous Testing Platform 10.7.5 - JSP command execution

Title: Parasoft Continuous Testing Platform 10.7.5- JSP command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Parasoft Continuous Testing Platform CTP from Parasoft United States, a closed-source commercial...

Exasol Database 7.1.30 - command execution

Title: Exasol Database 7.1.30 - command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux Advisory: https://0day-rubbish.com/blog/exasol-database-default-credential-python-udf-os-popen-rce CVE: pending Description: Exasol Database 7.1.3...

Synametrics Syncrify 6.2 - command execution

Title: Synametrics Syncrify 6.2 - command execution Author: 0day Rubbish Research Team Contact: [email protected] Type: remote Platform: Linux CVE: pending Description: Synametrics Syncrify 6.2 build 1178, the closed-source incremental backup and file-replication server from Synametrics...

Security update for aliyun-cli (important)

openSUSE security update: security update for aliyun-cli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22140-1 Rating: important References: bsc1283596 bsc1284203 Cross-References: CVE-2026-63209 CVSS scores: CVE-2026-63209 SUSE : 7.5...

php:7.4 security update

libzip 1.6.1-1 - update to 1.6.1 - enable lzma support 1.5.2-1 - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available 1.5.1-1 - update to 1.5.1 - drop dependency on zlib-devel and bzip2-devel no more referenced in libzip.pc...

PT-2026-120824

Name of the Vulnerable Software and Affected Versions itsourcecode Online Cake Ordering System version 1.0 Description A remote SQL injection is possible due to improper handling of the prcd variable within the /inserttrans.php endpoint. SQL injection is a technique where an attacker inserts...

SUSE CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...