Photon OS 5.0: Vim PHSA-2026-5.0-91-0908

An update of the vim package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0908. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

GHSA-WCX4-WPFV-MC5C jsii-diff: Command Injection via npm: package argument

Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impa...

CVE-2026-48078

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the nginx.ingress.kubernetes.io/rewrite-target annotation with a regular expression that captures attacker-controlled text without requiring a path separator for example path /api...

Photon OS 5.0: Libuv PHSA-2024-5.0-90-0213

An update of the libuv package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-90-0213. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Iputils PHSA-2025-5.0-91-0668

An update of the iputils package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0668. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CLSA-2026-1783645395 TuxCare security update for symfony/routing (2 CVEs)

TuxCare rebuilt symfony/routing to address 2 CVEs. Fixed in v4.4.44-p1+tuxcare...

CLSA-2026-1771375983 TuxCare security update for phpmailer/phpmailer (3 CVEs)

TuxCare rebuilt phpmailer/phpmailer to address 3 CVEs. Fixed in 5.2.28-p1+tuxcare...

CLSA-2026-1774484503 TuxCare security update for minimatch (3 CVEs)

TuxCare rebuilt minimatch to address 3 CVEs. Fixed in 0.3.0-tuxcare.1...

CLSA-2026-1774657399 TuxCare security update for ip (1 CVE)

TuxCare rebuilt ip to address 1 CVE. Fixed in 2.0.0-tuxcare.1...

ROOT-APP-NPM-CVE-2024-8373 CVE-2024-8373 in angular - Patched by Root

Root has patched CVE-2024-8373 in the angular package for Root:npm. Multiple fixed versions available...

JLSEC-2026-1123

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issu...

JLSEC-2026-1095

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...

SUSE CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

JLSEC-2026-939 ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch...

CLEANSTART-2026-FT49306 Security fixes in py3-urllib3 1.26.18-r0

Package py3-urllib3 version 1.26.18-r0 fixes 1 vulnerabilities: CVE-2023-45803...

CLEANSTART-2026-FV02233 Security fixes in opentofu-fips 1.8.11-r1

Package opentofu-fips version 1.8.11-r1 fixes 13 vulnerabilities: CVE-2025-61726, CVE-2025-68121, CVE-2025-61728, CVE-2025-68119, CVE-2025-61731...

CLEANSTART-2026-BM38174 Security fixes in istio 1.28.5-r2

Package istio version 1.28.5-r2 fixes 2 vulnerabilities: CVE-2025-15558, ghsa-p436-gjf2-799p...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3336-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3336-1 advisory. This update for ImageMagick fixes the following issue: - Extend CVE-2026-56379 patch by f63c78b bsc1268878. Tenable has...

CVE-2026-48060 Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...