SUSE CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

osbuild-composer security update

175-1.0.1 - Track github upstream...

CVE-2026-67872

Technical details about CVE-2026-67872 are not publicly available in the provided documents (no affected versions beyond 1.7.3, no root cause, impact specifics, or fix information). Monitor for updates.

Linux Distros Unpatched Vulnerability : CVE-2026-67592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage...

Jenkins LTS < 2.568.2 / Jenkins weekly < 2.576 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.568.2 or Jenkins weekly prior to 2.576. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles...

CVE-2026-67869

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the ServiceCall validates input arguments against runtime-resolved InputArguments metadata...

CVE-2026-67867

Systerel S2OPC 1.7.3 is affected by a Buffer Overflow vulnerability in the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data. The issue can be triggered remotely to cause a denial of service. The available documents confirm the affected product/version and the un...

CSRF vulnerability and missing permission checks in scm-manager

scm-manager 1.11.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

Stored XSS vulnerability in qualys-cs

qualys-cs 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix. Learn why we announce...

CVE-2026-67866

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMacProcessMsgDeleteMonitoredItemsResponse and SOPCStaMacNewDeleteMonitoredItems in the client wrapper DeleteMonitoredItems path...

Photon OS 5.0: Python3 PHSA-2024-5.0-91-0187

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-67869

The CVE-2026-67869 entry describes a Buffer Overflow in open62541 v1.5.5. The vulnerability affects the open62541 OPC UA server implementation, where a flaw in Service_Call leads to overflow when validating input arguments against runtime-resolved InputArguments metadata. This enables a remote at...

Linux Distros Unpatched Vulnerability : CVE-2026-67861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UAClientgetRemoteDataTypes component CVE-2026-67861 Note...

Oracle Linux 10 : nodejs24 (ELSA-2026-48034)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48034 advisory. - Fix CVE-2026-13149 brace-expansion Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...

Linux Distros Unpatched Vulnerability : CVE-2026-53504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on...

OpenSSL 4.0.0 < 4.0.2 Vulnerability

The version of OpenSSL installed on the remote host is prior to 4.0.2. It is, therefore, affected by a vulnerability as referenced in the 4.0.2 advisory. - Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP...

OPENSUSE-SU-2026:11455-1 libvirt-12.6.0-1.1 on GA media

These are all security issues fixed in the libvirt-12.6.0-1.1 package on the GA media of openSUSE Tumbleweed...

Missing permission checks in appscan allow enumerating credentials IDs

appscan 1.8.3 and earlier does not perform permission checks in multiple HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability...

Non-constant time webhook bearer token comparison in webhook-secret-credentials-provider

webhook-secret-credentials-provider 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook bearer toke...

Security update for thrift (important)

openSUSE Security Update: Security update for thrift Announcement ID: openSUSE-SU-2026:0275-1 Rating: important References: 1263321 1263322 1263365 1263438 1263492 1263557 1272609 1272645 1272647 1272648 1272649 1272650 1272651 1272652 1272653 1272654 1272655 1272656 1272657 1272658...