1045622 matches found
Fedora 45 : kernel (2026-7a0f444c64)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7a0f444c64 advisory. The 7.2.15 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...
CVE-2026-63499: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack... can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal...
CVE-2026-121141: Google Chrome: Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging…
Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121142: Google Chrome: Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…
Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...
CVE-2026-121196: Google Chrome: Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass…
Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121054: Google Chrome: Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…
Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121195: Google Chrome: Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web…
Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-95737: Hewlett Packard Enterprise (HPE) Fabric Composer: A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer
A privilege escalation vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with high privileges to gain elevated privileges on the underlying host operating system...
CVE-2026-121509: n/a Headless CMS Plugin: A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...
CVE-2026-121426: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr…
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domai...
CVE-2026-119179: MongoDB Node.js Driver: A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the…
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that...
CVE-2026-120955: MongoDB C Driver: The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain…
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...
CVE-2026-115716: Elastic APM Server: Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via…
Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...
CVE-2026-121407: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that…
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fata...
CVE-2026-103327: Unknown CryptoCloud: The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications…
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary...
CVE-2026-65108: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd…
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions...
CVE-2026-44266: enspirit elo: Elo is a purely functional expression language for no-code tools
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...
SUSE SLES12: gnutls / libgnutls-devel / libgnutls-openssl-devel / etc (SUSE-SU-2026:4943-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4943-1 advisory. This update for gnutls fixes the following issue: - CVE-2025-14831: excessive resource consumption when verifying specially crafted maliciou...
Linux Distros Unpatched Vulnerability : CVE-2026-112899
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Pillow project published security advisories for issues fixed in release 13.0.0. They include an argument injection in the Ghostscript call used for EPS...