Oracle Linux 8 : flatpak (ELSA-2026-89859)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-89859 advisory. - Use fd-relative operations for files/etc during runtime deploy CVE-2026-97024 Resolves: RHEL-272181 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-121218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and...

Linux Distros Unpatched Vulnerability : CVE-2026-115696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - iwd - None CVE-2026-115696 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Linux Distros Unpatched Vulnerability : CVE-2026-121223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium...

CVE-2026-121748: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

Linux Distros Unpatched Vulnerability : CVE-2026-121247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbo...

CVE-2026-121749: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to grep as a bare argument, without -e, in nvmlsremoteindextab, nvmremoteversion, and nvmlscached. A .nvmrc whose first li...

RHEL 9 : flatpak (RHSA-2026:95061)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95061 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: flatpak:...

Linux Distros Unpatched Vulnerability : CVE-2026-121031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-121250

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary co...

RHEL 8 : pki-core:10.6 (RHSA-2026:95097)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:95097 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: Dogtag/PKI:...

CVE-2026-122016: yangzongzhuan RuoYi-Vue: A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2

A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms causes improper privilege management. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-121101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access...

Linux Distros Unpatched Vulnerability : CVE-2026-121204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...

CVE-2026-104203: traccar: Traccar is an open source GPS tracking system

Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/. An unauthenticated attacker who knows or guesses a device unique ID and...

CVE-2026-122233: php frankenphp: FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP…

FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling httpgetlastresponseheaders can read...

CVE-2026-122234: benjamine jsondiffpatch: jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by…

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format or formatters.annotated.format can embed script that...

CVE-2026-97373: jgraph drawio: draw.io is a configurable diagramming and whiteboarding application

draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 shared address range 100.64.0.0/10. An...