sandbox-runtime v0.0.76

Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...

fyp

SecureXPro A desktop-based vulnerability assessment tool that...

[SECURITY] Fedora 44 Update: nagios-plugins-2.5-2.fc44

Nagios is a program that will monitor hosts and services on your network, and to email or page you when a problem arises or is resolved. Nagios runs on a Unix server as a background or daemon process, intermittently running checks on various services that you specify. The actual service checks ar...

Chromium CVE-2026-76022: Buffer overflow in Network

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-90561

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2026-77752: Improper Privilege Management

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

Fedora 45 : golang-x-perf (2026-09a9388be9)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-09a9388be9 advisory. Update to 19be9d8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Linux Distros Unpatched Vulnerability : CVE-2026-80978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can...

Fedora 43 : bluez (2026-6ed52ea50e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ed52ea50e advisory. This update fixes a number of security issues. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

azure-storage-azcopy-10.32.8-1.1 on GA media (moderate)

azure-storage-azcopy-10.32.8-1.1 on GA media Announcement ID: openSUSE-SU-2026:11740-1 Rating: moderate Cross-References: CVE-2026-84304 CVE-2026-84445 CVSS scores: CVE-2026-84304 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-84304 SUSE : 8.7...

perl-Protocol-HTTP2-1.140.0-1.1 on GA media (moderate)

perl-Protocol-HTTP2-1.140.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11735-1 Rating: moderate Cross-References: CVE-2026-16028 CVSS scores: CVE-2026-16028 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-16028 SUSE : 8.7...

perl-Authen-SASL-2.210.0-1.1 on GA media (moderate)

perl-Authen-SASL-2.210.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11734-1 Rating: moderate Cross-References: CVE-2026-86219 CVSS scores: CVE-2026-86219 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-86219 SUSE : 9.1...

Chromium CVE-2026-85043: Incomplete cleanup in Network

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-89715

A flaw was found in the Linux kernel's NFS/localio component. A race condition during file handling can lead to a reference leak, where system resources are not properly released. This continuous accumulation of unreleased references can exhaust available resources, preventing network namespace...

CVE-2026-89488

A flaw was found in the Linux kernel's Open vSwitch OVS component. An unprivileged user, operating from a user and network namespace, can trigger a use-after-free vulnerability during network namespace teardown. This occurs because packet processing attempts to use connection tracking CT limit...

CVE-2026-90452

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-90452 Improper certificate validation in Malcolm

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-54166 Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...