Atlassian Confluence 6.6.x < 9.2.24 / 9.3.x < 10.2.17 / 11.0.0 (CONFSERVER-104474)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104474 advisory. - ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications,...

Linux Distros Unpatched Vulnerability : CVE-2026-98623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then pstate is not a valid pstate...

Fedora 43 : baresip / libre (2026-ff2a4f31ce)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ff2a4f31ce advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

Atlassian Jira Service Management Data Center and Server < 10.3.13 / 10.4.x < 11.1.1 (JSDSERVER-16831)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16831 advisory. - In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpe...

Linux Distros Unpatched Vulnerability : CVE-2026-98621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to...

Linux Distros Unpatched Vulnerability : CVE-2026-98719

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Nullify have run CPUs mask pointer when freeing it Nullify haveruncpus when freeing the mask, particularly in the error path of sevguestinit, so that...

Linux Distros Unpatched Vulnerability : CVE-2026-98651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to...

PT-2026-118623

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The stdlib venv creator reads the generated pyvenv.cfg using str.splitlines and merges the parsed keys over the selected configuration. An untrusted caller who can influence the destination...

PT-2026-118631

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.7 Description The bash activate script fails to properly escape the environment name during the two passes bash performs over the PS1 prompt variable. Consequently, a backslash in the environment name can und...

PT-2026-120139

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.2 Description The FishActivator component inherits ViaTemplateActivator.quote, which utilizes the POSIX shlex.quote function. Because the fish shell interprets backslashes and single quotes differently than...

PT-2026-118614

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.8 through 21.14.9 Description The app-data seeder may leave an environment linked to temporary package files that are deleted upon completion of the creation process. This state can be triggered via environment-variab...

PT-2026-118465

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, whe...

PT-2026-120144

Name of the Vulnerable Software and Affected Versions Imager::File::GIF versions prior to 1.006 Imager affected versions not specified Description An issue exists when consolidating GIF images where palette indices are used without verifying the colour table bounds. Specifically, the i readgif lo...

Security update for grafana (important)

openSUSE security update: security update for grafana ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22125-1 Rating: important References: bsc1263330 bsc1265525 bsc1265763 bsc1268868 bsc1269841 bsc1271330 bsc1272008 bsc1272328 bsc1272427 bsc1274217...

PT-2026-118350

Name of the Vulnerable Software and Affected Versions StreamsHub Console operator affected versions not specified Description The operator acts as a confused deputy, allowing a Kubernetes tenant with permissions to create a Console custom resource to access secrets from any namespace. By...

PT-2026-118497

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 1.25.0 through 1.27.0 Description When the uploadfs component is configured with the Azure backend and the sas variable is set to true, the createContainer function builds the BlobServiceClient using a URL that includes...

PT-2026-118448

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The application contains an issue where the endpoint 'POST /api/v1/@apostrophecms/doc/slugTaken' does not implement permission or type filters when processing the slug variable in the request...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Apache Paimon versions 2.1.0 and 2.0.0 MySQL CDC synchronization actions allow user-supplied JDBC properties that can enable a rogue MySQL server to request arbitrary local files from the CDC process. !/usr/bin/env bash Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read Vendor: The Apache Software...

PT-2026-118500

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because th...

Linux Distros Unpatched Vulnerability : CVE-2026-98641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes...