CVE-2026-118783: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode…

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2026-11753: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is…

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL...

CVE-2026-110935: Phoenix Contact PLCnext Engineer: The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the…

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plug...

CVE-2026-111962: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it…

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests th...

CVE-2026-121146: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

TencentOS Server 2: virtuoso-opensource (TSSA-2026:1353)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1353 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-114595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent...

Fedora 45 : fractal (2026-4594d6891a)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4594d6891a advisory. 14.3 ---- 14.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

Fedora 43 : fractal (2026-db5dd4bc2f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-db5dd4bc2f advisory. 14.3 ---- 14.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

Linux Distros Unpatched Vulnerability : CVE-2026-120635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-da...

Linux Distros Unpatched Vulnerability : CVE-2026-99270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: Fix potential UAF in reqsktimerhandler. When TCP socket migration fails at inetehashinsert in reqsktimerhandler, we jump to the noownership: label and free...

Fedora 43 : selenium-manager (2026-7f0feca48a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7f0feca48a advisory. Rebuilt with latest rustls/rustls-webpki - rustls 0.23.46 addresses RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349 -...

Fedora 45 : mingw-qt6-qt5compat (2026-7c38829d5a)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7c38829d5a advisory. Backport fix for CVE-2026-101201. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Linux Distros Unpatched Vulnerability : CVE-2026-111211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize,...

Linux Distros Unpatched Vulnerability : CVE-2026-120637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as...

CVE-2026-122009: DataLinkDC Dinky: A flaw has been found in DataLinkDC Dinky up to 1.2.5

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of...

CVE-2026-113782: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework

ESP-IDF is the Espressif Internet of Things IOT Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the...

TencentOS Server 2: gstreamer-plugins-bad-free (TSSA-2026:1354)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1354 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-120634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a...

TencentOS Server 2: webkitgtk4 (TSSA-2026:1366)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1366 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...