Fedora 43 : skopeo (2026-4d9a2870e5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d9a2870e5 advisory. Security fix for CVE-2026-27145 Go stdlib crypto/x509 DoS vulnerability. Rebuild with golang-1.25.12 which includes the fix. Tenable has extracted the...

PT-2026-64879

Name of the Vulnerable Software and Affected Versions Apache Thrift versions 0.19.0 through 0.23.x Description Allocation of Resources Without Limits or Throttling in Apache Thrift Java bindings can lead to an unbounded read, potentially resulting in a Denial of Service DoS, a condition where a...

PT-2026-64881

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper validation of certificates with host mismatch occurs in the Apache Thrift C++ bindings. This issue involves a wildcard bypass in the matchName function of the TSSLSocket class, failin...

PT-2026-64890

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An out-of-bounds read issue exists in the Apache Thrift c glib bindings, specifically occurring within the transport leftover-bytes path. An out-of-bounds read is a condition where a program...

PT-2026-64893

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Apache Thrift Python bindings contain an issue where certificates with host mismatches are not properly validated. Recommendations Upgrade to version 0.24.0...

CVE-2026-51565

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

PT-2026-65091

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Ticket...

PT-2026-64891

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An allocation of resources without limits or throttling issue exists in the Apache Thrift Rust bindings. Specifically, the Rust binary protocol non-strict path lacks a string size limit, which...

PT-2026-65065

Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6 Description An integer underflow exists in the multipart MIME body parser. Unauthenticated remote attackers can crash the server process by sending a crafted Content-Disposition header with an empty field...

PT-2026-64880

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper validation of certificates with host mismatch occurs in the Apache Thrift c glib bindings. This issue results in the TLS client failing to perform necessary hostname verification...

PT-2026-64853

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

Atlassian Jira Service Management Data Center and Server 10.0.x / 10.1.1 / 10.2.x / 10.3.x < 10.3.7 / 10.4.x / 10.5.x / 10.6.x / 11.x < 11.3.8 (JSDSERVER-16652)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16652 advisory. - This High severity BASM Broken Authentication & Session Management vulnerability was introduced in...

Security Advisory 0144

Security Advisory 0144 . CSAF PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release 1.1 | August 3, 2026 | Updated Affected Platforms to include: VeloCloud Orchestrator Hosted 1.2 | August 10, 2026 | Added CSAF JSON file for download The CVE-ID tracki...

SUSE-SU-2026:3254-1 Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.109 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060....

CVE-2026-61108

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: GIS. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged...

CVE-2026-47064

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

CVE-2026-60181

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Configurator. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Difficult to exploit vulnerability allows low...

Exploit for Missing Authentication for Critical Function in Cpanel

cPanel-CVE-2026-41940-auth-bypass-exploit Critical authenticat...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 PoC for Galaxy S24 Ultra SM-S928U1 Device-sp...

CVE-2026-17459

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possib...