CGA-6XVF-X3HW-96FW

Bulletin has no description...

Fedora 44 : tigervnc (2026-e7c97d043e)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e7c97d043e advisory. Fixes CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264. Tenabl...

RHEL 10 : postgresql16 (RHSA-2026:27743)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:27743 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that...

SUSE SLES15 Security Update : rootlesskit (SUSE-SU-2026:2452-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2452-1 advisory. This update for rootlesskit rebuilds it against the current go security release. Tenable has extracted the preceding description block...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-57481 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-57481 Source advisory: SNYK:JS-PARSESERVER-17420045...

@kozou/api (>=1.0.0, <=1.8.0), @kozou/codegen (>=1.0.0, <=1.8.0) +5 more potentially affected by unknown CVE via @kozou/core (>=1.0.0, <=1.8.0)

@kozou/core NPM version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: SNYK:JS-KOZOUCORE-17818146...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/api (>=1.0.0, <=1.8.0)

@kozou/api NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: SNYK:JS-KOZOUAPI-17818148...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/api (>=1.0.0, <=1.8.0)

@kozou/api NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-55778 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-55778 Source advisory: SNYK:JS-PARSESERVER-17420047...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-57480 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-57480 Source advisory: SNYK:JS-PARSESERVER-17420049...

GHSA-6RFW-MQ36-JM8H Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore is an open-source SDK that enables developers to build, deploy, and manage agents on AWS Bedrock AgentCore. An issue exists in the installpackages method of the Code Interpreter client where crafted package name arguments can bypass...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +690 more potentially affected by CVE-2026-9679 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.26.4, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =0.5.1 - @anyauth/shared-deps 0.1.0 and more Source cves: CVE-2026-9679 Source advisory: OSV:GHSA-P88M-4JFJ-68FV...

@0xwork/connect (>=0.1.8, <=0.1.9), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +489 more potentially affected by CVE-2026-6733 via undici (>=8.0.0, <=8.4.1)

undici NPM version =8.0.0, =0.1.8, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =2026.6.2, =1.0.0, =0.6.10, =0.3.1, =2026.5.2-zh, =0.2.0, =0.18.5 and more Source cves:...

External Initialization of Trusted Variables or Data Stores

Overview Affected versions of this package are vulnerable to External Initialization of Trusted Variables or Data Stores in the installation process when the Forwarded, X-Client-IP, or X-Real-IP headers are set by a reverse proxy. An attacker can gain unauthorized administrative access by remotel...

@3ngram/server (0.7.0), @compeso/node-red-contrib-imap-email (1.0.0) +7 more potentially affected by unknown CVE via nodemailer (9.0.0)

nodemailer NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nodemailer and may be impacted: - @3ngram/server 0.7.0 - @compeso/node-red-contrib-imap-email 1.0.0 - @hybridaione/hybridclaw =0.25.3, =0.25.8 - @postalsys/email-ai-tools 1.13...

tamilai (0.0.2) potentially affected by CVE-2026-57134 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57134 Source advisory: SNYK:JS-PRAISONAI-17660576...

AlmaLinux 8 : xorg-x11-server-Xwayland (ALSA-2026:26562)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:26562 advisory. xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch...

PT-2026-50580

Name of the Vulnerable Software and Affected Versions PTC Windchill PDMlink versions prior to 11.0 M030 PTC FlexPLM versions prior to 11.0 M030 All CPS versions Description A critical remote code execution RCE issue exists due to improper input validation and the deserialization of untrusted data...

CGA-8MJ6-4H5X-2Q3W

Bulletin has no description...

@liqi0816/chrome-devtools-mcp-rebrowser (>=1.0.0, <=1.0.3), @mallocfeng/chromedev (>=0.1.0, <=0.1.8) +10 more potentially affected by CVE-2026-53765 via chrome-devtools-mcp (>=0.20.3, <=0.25.0)

chrome-devtools-mcp NPM version =0.20.3, =1.0.0, =0.1.0, =0.2.8, =0.2.7, =2.0.0, =0.1.5, =0.1.49, =1.0.5, =1.0.1, =1.0.9 Source cves: CVE-2026-53765 Source advisory: OSV:GHSA-3PVJ-JV98-QHJQ...