CVE-2025-71453: vtenext: vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php…

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys,...

CVE-2026-113374: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission nexus:capabilities:create can create this capability, which turns on header-based authentication for the instance. A...

CVE-2026-17493: IBM Watson Speech Services Cartridge: IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due…

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read...

CVE-2026-54373: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows…

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network security configuration. Attackers on an untrusted network can...

CVE-2026-122148: Yealink MeetingBoard Pro: In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass…

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot...

CVE-2026-105702: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details...

CVE-2026-108838: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-19319: IBM Watson Speech Services Cartridge: IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information…

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

Rocky Linux 8 [CIQ] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_93924)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693924 advisory. qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization CVE-2026-11573 qt5-qtbase: qt6-qtbase: Qt: Denia...

Linux Distros Unpatched Vulnerability : CVE-2026-120639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : HAProxy vulnerabilities (USN-8972-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8972-1 advisory. It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use thi...

Fedora 45 : rust-app-store-connect (2026-191f54446d)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-191f54446d advisory. Rebuilt with the latest Rust dependencies, addressing at least RUSTSEC-2026-0190. Tenable has extracted the preceding description block directly from the...

Fedora 43 : selenium-manager (2026-7f0feca48a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7f0feca48a advisory. Rebuilt with latest rustls/rustls-webpki - rustls 0.23.46 addresses RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349 -...

Linux Distros Unpatched Vulnerability : CVE-2026-120637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as...

Linux Distros Unpatched Vulnerability : CVE-2026-111211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize,...

TencentOS Server 2: glib2 (TSSA-2026:1365)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1365 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-99270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: Fix potential UAF in reqsktimerhandler. When TCP socket migration fails at inetehashinsert in reqsktimerhandler, we jump to the noownership: label and free...

Linux Distros Unpatched Vulnerability : CVE-2026-114582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform...

Linux Distros Unpatched Vulnerability : CVE-2026-114597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the...

TencentOS Server 2: gstreamer-plugins-bad-free (TSSA-2026:1354)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1354 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...