[SECURITY] Fedora 44 Update: golang-x-perf-0-0.36.20260904git19be9d8.fc44

This package holds the source for various tools related to performance measurement, storage, and analysis. - cmd/benchstat contains a command-line tool that computes and 7 compares statistics about benchmarks. - cmd/benchsave contains a command-line tool for publishing benchmark results. - storag...

[SECURITY] Fedora 43 Update: golang-x-perf-0-0.36.20260904git19be9d8.fc43

This package holds the source for various tools related to performance measurement, storage, and analysis. - cmd/benchstat contains a command-line tool that computes and 7 compares statistics about benchmarks. - cmd/benchsave contains a command-line tool for publishing benchmark results. - storag...

[SECURITY] Fedora 45 Update: golang-x-perf-0-0.36.20260904git19be9d8.fc45

This package holds the source for various tools related to performance measurement, storage, and analysis. - cmd/benchstat contains a command-line tool that computes and 7 compares statistics about benchmarks. - cmd/benchsave contains a command-line tool for publishing benchmark results. - storag...

PT-2026-90987

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

Fedora 44 : golang-x-perf (2026-cdaa0a840e)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cdaa0a840e advisory. Update to 19be9d8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2026-90603: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90580: Server-Side Request Forgery (SSRF)

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

PT-2026-90951

Name of the Vulnerable Software and Affected Versions FlowiseAI Flowise versions prior to 3.1.3 Description A server-side request forgery SSRF exists in the Evaluations Endpoint component within the axios.post function of the packages/server/src/controllers/evaluations/index.ts file. This issue...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003819)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003819 advisory. Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This ma...

[SECURITY] [DSA 6497-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6497-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 12, 2026 https://www.debian.org/security/faq -...

CVE-2026-90558: Stack-based Buffer Overflow

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause...

Fedora 45 : golang-x-perf (2026-09a9388be9)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-09a9388be9 advisory. Update to 19be9d8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Debian dsa-6497 : xnest - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6497 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6497-1 [email protected] https://www.debian.org/securit...

rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

[SECURITY] Fedora 45 Update: nss-3.127.0-1.fc45

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

SUSE CVE-2026-18174

@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...

WordPress Auto x LINE plugin <= 1.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Auto x LINE versions = 1.0.0...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...