Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.19.6 security update

Important: Red Hat OpenShift GitOps v1.19.6 security update An update is now available for Red Hat OpenShift GitOps...

Photon OS 5.0: Glib PHSA-2026-5.0-90-0763

An update of the glib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Kafka PHSA-2026-5.0-91-0855

An update of the kafka package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0855. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Go PHSA-2026-5.0-90-0763

An update of the go package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0763. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

OPENSUSE-SU-2026:11487-1 java-1_8_0-openj9-1.8.0.502-1.1 on GA media

These are all security issues fixed in the java-180-openj9-1.8.0.502-1.1 package on the GA media of openSUSE Tumbleweed...

Photon OS 5.0: Vim PHSA-2026-5.0-91-0908

An update of the vim package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0908. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

GHSA-WCX4-WPFV-MC5C jsii-diff: Command Injection via npm: package argument

Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impa...

CVE-2026-48078

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the nginx.ingress.kubernetes.io/rewrite-target annotation with a regular expression that captures attacker-controlled text without requiring a path separator for example path /api...

ROOT-APP-NPM-GHSA-R7G4-QG5F-QQM2 GHSA-r7g4-qg5f-qqm2 in nodemailer - Patched by Root

Root has patched GHSA-r7g4-qg5f-qqm2 in the nodemailer package for Root:npm. Multiple fixed versions available...

CLSA-2026-1774484503 TuxCare security update for minimatch (18 CVEs)

TuxCare rebuilt minimatch to address 18 CVEs. Fixed in 0.3.0-tuxcare.1...

CLSA-2026-1774657399 TuxCare security update for ip (13 CVEs)

TuxCare rebuilt ip to address 13 CVEs. Fixed in 2.0.0-tuxcare.1...

ROOT-APP-NPM-CVE-2024-8373 CVE-2024-8373 in angular - Patched by Root

Root has patched CVE-2024-8373 in the angular package for Root:npm. Multiple fixed versions available...

SUSE CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

JLSEC-2026-939 ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch...

CLEANSTART-2026-FT49306 Security fixes in py3-urllib3 1.26.18-r0

Package py3-urllib3 version 1.26.18-r0 fixes 1 vulnerabilities: CVE-2023-45803...

CLEANSTART-2026-FV02233 Security fixes in opentofu-fips 1.8.11-r1

Package opentofu-fips version 1.8.11-r1 fixes 13 vulnerabilities: CVE-2025-61726, CVE-2025-68121, CVE-2025-61728, CVE-2025-68119, CVE-2025-61731...

CLEANSTART-2026-BM38174 Security fixes in istio 1.28.5-r2

Package istio version 1.28.5-r2 fixes 2 vulnerabilities: CVE-2025-15558, ghsa-p436-gjf2-799p...

CVE-2026-48060 Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

EUVD-2026-49991

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...