CVE-2026-75421

aria2 =1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine function...

Fedora 44 : freeipa / samba (2026-903d904933)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-903d904933 advisory. Update to Samba 4.24.6 and rebuild of freeipa ---- This update contains no changes; it exists purely to keep the Fedora 44 freeipa package...

Oracle Linux 8 : python3.12 (ELSA-2026-58971)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-58971 advisory. 3.12.14-1 - Update to Python 3.12.14 Resolves: RHEL-227198 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Fedora 43 : kernel (2026-6d18f005f1)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d18f005f1 advisory. The 7.1.10 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream...

JetBrains TeamCity < 2020.1.2 (CVE-2020-27627)

The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.2. It is, therefore, affected by a vulnerability: - JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. CVE-2020-27627 Note that Nessus has not tested for this issue but has instead relied only on th...

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78264

Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...

CVE-2026-78267

Unauthenticated Privilege Escalation in TranslatePress = 3.3.2 versions...

CVE-2026-78259

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

CVE-2026-32561

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-27364

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-32554

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-78267

CVE-2026-78267 is an unauthenticated privilege escalation vulnerability in the TranslatePress WordPress plugin, affecting versions 3.3.2 and earlier . With a CVSS 3.1 score of 9.8 (Critical) , the flaw is exploitable over the network with low complexity, requiring no prior authentication or user ...

CVE-2026-78266 WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...

CVE-2026-78263

Event Tickets WordPress plugin versions

CVE-2026-78259

CVE-2026-78259 is an unauthenticated Broken Authentication vulnerability in the WPLegalPages WordPress plugin, affecting versions ≤ 3.7.0 . A remote, unauthenticated attacker can exploit this over the network with low complexity and no user interaction, resulting in low-impact compromises to conf...

CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-32561

CVE-2026-32561 is a Subscriber Privilege Escalation vulnerability in the WordPress Booking Hub plugin, affecting versions 1.3.0 and earlier . The flaw allows a low-privileged Subscriber user to escalate privileges, rated CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indica...