Fedora 44 : apptainer (2026-8deee54909)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8deee54909 advisory. Update to upstream 1.5.5. Includes fix for go CVE-2026-111943. Tenable has extracted the preceding description block directly from the Fedora security...

Rocky Linux 10.2 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_93596)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693596 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via multipl...

CVE-2026-14252: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-118623: MLflow: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit...

CVE-2026-103002: gpustack: GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, clusterapiserverproxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a...

CVE-2026-121609: Qihoo 360 Whole Home Router M5: A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2026-121618: Linksys E5600: A weakness has been identified in Linksys E5600 1.1.0.26

A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This manipulation causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the...

CVE-2026-118626: MLflow: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuratio...

CVE-2026-118627: MLflow: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-92198: Quest Foglight for Databases: Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability

Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Quest Foglight for Databases. Authentication is not required to exploit th...

CVE-2026-92196: Quest Foglight for Databases: Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability

Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this...

CVE-2026-92199: Quest Foglight for Databases: Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability

Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute...

CVE-2026-118783: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode…

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2026-11753: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is…

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL...

CVE-2026-110935: Phoenix Contact PLCnext Engineer: The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the…

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plug...

CVE-2026-111962: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it…

The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests th...

CVE-2026-121146: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

TencentOS Server 2: virtuoso-opensource (TSSA-2026:1353)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1353 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-114595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent...

Fedora 45 : fractal (2026-4594d6891a)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4594d6891a advisory. 14.3 ---- 14.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...