CVE-2026-64664

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

[SECURITY] [DLA 4721-1] async-http-client security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4721-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 06, 2026 https://wiki.debian.org/LTS -...

RHSA-2026:50774 Red Hat Security Advisory: libtiff security update

Bulletin has no description...

CVE-2026-64593

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not trim a device which is not writeable BUG There is a bug report that btrfs/242 can randomly fail with the following NULL pointer dereference: run fstests btrfs/242 at 2026-06-01 10:25:08 BTRFS: device fsid...

SUSE CVE-2026-64566

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

ffmpeg-4-4.4.8-3.1 on GA media (moderate)

ffmpeg-4-4.4.8-3.1 on GA media Announcement ID: openSUSE-SU-2026:11448-1 Rating: moderate Cross-References: CVE-2026-64830 CVE-2026-64832 CVE-2026-64835 CVE-2026-66038 CVE-2026-66039 CVSS scores: CVE-2026-64830 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2026-64830 SUSE : 8.5...

RHEL 9 : RHEL AI 3.4 RPM runtime CVE fix - aom (Important) (RHSA-2026:51146)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51146 advisory. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application...

CVE-2026-71313 rclone: Local Encoding Path Traversal

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-20268

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-20269 Cisco IOS XE Software Security Hardening Release

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-70599

CVE-2026-70599 concerns Electron. Before versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, permission checks for serial-port and media accessed via an iframe could pass the top‑level origin to session.setPermissionCheckHandler instead of the requesting iframe origin. This allowed an origin‑base...

CVE-2026-70595 Ghost: Server-Side Request Forgery Mitigation Issue

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

ROOT-APP-PYPI-GHSA-V396-V7Q4-X2QJ GHSA-v396-v7q4-x2qj in GitPython - Patched by Root

Root has patched GHSA-v396-v7q4-x2qj in the GitPython package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1785934478 TuxCare security update for certifi (1 CVE)

TuxCare rebuilt certifi to address 1 CVE. Fixed in 2023.7.22.post2+tuxcare...

UBUNTU-CVE-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...

Photon OS 5.0: Wget PHSA-2024-5.0-91-0331

An update of the wget package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0331. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLES15 Security Update : bind (SUSE-SU-2026:3476-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3476-1 advisory. This update for bind fixes the following issues - CVE-2026-10723: Incorrect acceptance of NSEC3 records bsc1271982. - CVE-2026-1133...

Photon OS 5.0: Samba PHSA-2025-5.0-91-0648

An update of the samba package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0648. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Ghost: Paid gift memberships obtainable at minimal cost via the donations feature

Impact A vulnerability in Ghost's public donation checkout flow allowed an unauthenticated attacker to obtain full paid gift memberships for a minimal payment. No customer or member data was exposed, and the issue could not be used to steal money from a site or its members. Vulnerable versions Th...

EUVD-2026-52973

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...