AlmaLinux 9.2 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793693567)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793693567 advisory. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists that undersizes the output buffer when...

Fedora 45 : mingw-cfitsio (2026-5bfcad5462)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5bfcad5462 advisory. Backport fix for CVE-2026-115504. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

CVE-2026-115779: Effect-TS, @effect: Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript…

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

RockyLinux 10 : libXi (RLSA-2026:93441)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93441 advisory. libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION...

RockyLinux 9 : bind (RLSA-2026:93610)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93610 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

CVE-2026-114582: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-118489: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…

In Eclipse Vert.x versions 4.0.0,4.5.35 or 5.0.0,5.2.2, when one CachingWebClient is shared across users — the documented pattern of a per-user WebClientSession over a shared caching client — a response that is specific to one user but is cacheable and not marked private/no-store is stored in the...

RHEL 8 : libXtst (RHSA-2026:94449)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94449 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

Fedora 45 : erlang-hex_core (2026-b514ab4cac)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b514ab4cac advisory. hexcore ver. 0.21.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

AlmaLinux 8 : firefox (ALSA-2026:89756)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:89756 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 firefox: thunderbird: Privilege escalation in the Application Update component...

FreeBSD : freenginx -- TLS session ticket key left uninitialized (4784aba5-d6a9-11f1-8a93-a0369f6e85b8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4784aba5-d6a9-11f1-8a93-a0369f6e85b8 advisory. The freenginx project reports: One of the keys was left uninitialized when using automatic rotation of...

SUSE SLES15: Multiple Vulnerabilities (SUSE-RU-2026:5018-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-RU-2026:5018-1 advisory. - Allow to bypass the strict tag initialization and length enforcement added in the fix for CVE-2026-34182 when the env variable...

AlmaLinux 9.2 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.2:CLSA-2026:1792633697)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792633697 advisory. - The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only...

SUSE SLES12 Security Update : gnutls (SUSE-SU-2026:4953-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4953-1 advisory. This update for gnutls fixes the following issue: - CVE-2025-14831: excessive resource consumption when verifying specially crafted maliciou...

RockyLinux 9 : tomcat (RLSA-2026:93469)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93469 advisory. tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to...

RHEL 9 : pipewire (RHSA-2026:94437)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94437 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: RAOP RTSP NULL Deref...

Langflow 1.0.x < 1.13.0 Multiple Vulnerabilities

The version of Langflow installed on the remote host is 1.0.x prior to 1.13.0. It is, therefore, affected by multiple vulnerabilities: - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. CVE-2026-93680 - IBM Langflo...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:93617)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:93617 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multiple...

CentOS Linux 8 [TuxCare] Security Update: lemon / sqlite / sqlite-analyzer / sqlite-devel / sqlite-doc / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793699740)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793699740 advisory. - SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting...

RockyLinux 8 : perl-YAML:1.24 (RLSA-2026:93471)

The remote RockyLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:93471 advisory. perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment CVE-2019-25777 perl-yaml: perl-yaml: Arbitrary destructor...