CVE-2026-122134: mistralai mistral-vibe: Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by…

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup,...

CVE-2026-122135: mistralai mistral-vibe: Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by…

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

CVE-2026-122136: romkatv powerlevel10k: Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local…

Powerlevel10k before 1.20.19 contains a symlink following vulnerability in p9kdumpinstantprompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output- - in TMPDIR, guessing the victim's shell...

CVE-2026-102280: sandboxie-plus Sandboxie: Sandboxie-Plus is an open source sandbox-based isolation software for Windows

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGIDFILESETATTRIBUTES or MSGIDFILESETSHORTNAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primiti...

CVE-2026-115473: cesanta mongoose: Mongoose is an embedded web server and network library

Mongoose is an embedded web server and network library. Prior to 7.22, mgpathissane in src/util.c read path.buf1 without first requiring path.len to be at least two and read s2 when only two bytes remained. Unauthenticated remote requests reaching mghttpupload or mghttpservedir with the affected...

CVE-2026-121747: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether .nvmrc is a symbolic link. A repository or archive that ships .nvmrc as a symlink to another file for example ../../.npmrc, or...

Linux Distros Unpatched Vulnerability : CVE-2026-121437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter...

Linux Distros Unpatched Vulnerability : CVE-2026-121032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromiu...

Linux Distros Unpatched Vulnerability : CVE-2026-121116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to...

Fedora 43 : libical (2026-13d6a67e0d)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-13d6a67e0d advisory. Add a patch for CVE-2026-111269: Denial of Service via out-of-bounds read in icalvaluedecodeicalstring Tenable has extracted the preceding description block...

Ubuntu 16.04 LTS : Linux kernel (AWS) vulnerability (USN-8967-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8967-1 advisory. Jrgen Gro discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process...

RockyLinux 9 : dpdk (RLSA-2026:94629)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:94629 advisory. dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup CVE-2026-86561 dpdk: dpdk: Control-queue descriptor double-fetch...

Linux Distros Unpatched Vulnerability : CVE-2026-121244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a craft...

Ubuntu 16.04 LTS : Sprockets vulnerability (USN-8990-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8990-1 advisory. It was discovered that Sprockets incorrectly handled certain specially crafted requests when the Sprockets server was used in production. A remote attacker could...

Linux Distros Unpatched Vulnerability : CVE-2026-121123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

TencentOS Server 2: bind (TSSA-2026:1360)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1360 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Fedora 43 : chromium (2026-0168c5c231)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0168c5c231 advisory. Update to 156.0.8078.73, include 21 security fixes CVE-2026-119260: Use after free in Frames CVE-2026-119261: Improper input validation in Skia...

Fedora 45 : python3.9 (2026-7d4610faad)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7d4610faad advisory. - Security fix for CVE-2026-11940 - Security fix for CVE-2026-15308 Tenable has extracted the preceding description block directly from the Fedora...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Relax-and-Recover vulnerability (USN-8988-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8988-1 advisory. It was discovered that Relax-and-Recover created a world-readable initrd when GRUBRESCUE was enabled. A local attacker could possibly use...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : libsoup vulnerabilities (USN-8975-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8975-1 advisory. It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote...