MIMEDefang Email Scanner 3.7.3

MIMEDefang is a flexible MIME email scanner designed to protect Windows clients from viruses. Includes the ability to do many other kinds of mail processing, such as replacing parts of messages with URLs. It can alter or delete various parts of a MIME message according to a very flexible...

CVE-2026-90626: Apache Software Foundation Apache OpenOffice: An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF…

An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, which fixes this issue...

Fedora 45 : rust-app-store-connect (2026-191f54446d)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-191f54446d advisory. Rebuilt with the latest Rust dependencies, addressing at least RUSTSEC-2026-0190. Tenable has extracted the preceding description block directly from the...

CVE-2026-113371: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST…

Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository...

MiracleLinux 9 : bind-9.16.23-40.el9_8.13 (AXSA:2026-2239:15)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2239:15 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

Fedora 43 : fractal (2026-db5dd4bc2f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-db5dd4bc2f advisory. 14.3 ---- 14.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

CVE-2026-118422: Unknown Stape Conversion Tracking: The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin…

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned fr...

CVE-2026-115426: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage…

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup locati...

CVE-2025-71455: vtenext: vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the…

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and...

CVE-2026-108067: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before…

The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other...

CVE-2026-115241: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot…

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other...

CVE-2026-122220: wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN): WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay…

WPO365 | LOGIN wpo365-login plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2Service::checkmessageid, which never persists processed SAML message IDs to the wpo365samlmessageids transient due to a log...

Linux Distros Unpatched Vulnerability : CVE-2026-114596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an...

Ubuntu 22.04 LTS / 24.04 LTS : Gin CORS middleware vulnerability (USN-8983-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8983-1 advisory. It was discovered that the Gin CORS middleware incorrectly handled wildcards at the end of origin strings. A remote attacker could possibly use this...

Fedora 45 : rubygem-gist (2026-26f9e93952)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-26f9e93952 advisory. Verify TLS server certificate fixes fedora2546280 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

TencentOS Server 2: glib2 (TSSA-2026:1365)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1365 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-114597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the...

CVE-2026-121639: WatchGuard AuthPoint Authentication Gateway: A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote…

A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration...

CVE-2026-111962: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it…

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests th...

CVE-2026-121941: munt libmt32emu: libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows…

libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emuparsestream AP...