CVE-2026-111492: TPC Software Matchpoint: SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase…

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive...

CVE-2026-105325: Apache Software Foundation Apache OFBiz: Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW…

Missing check for ACCOUNTINGUPDATE / ACCOUNTINGCREATE in accounting in allows user with only ACCOUNTINGVIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

CVE-2026-16304: Unknown WP Event Manager: The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the…

The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to...

CVE-2026-102927: hedgedoc: HedgeDoc is an open source, real-time collaborative markdown notes application

HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks...

CVE-2026-65983: openemr: OpenEMR is a free and open source electronic health records and medical practice management application

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custommodules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::getdata and...

CVE-2026-96677: Apache Software Foundation Apache Juneau: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome header, nav, aside, footer and similar fields. Applications whose chrome includes...

CVE-2026-88984: kubeflow pipelines: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.16.1, the multi-user API server treats the empty namespace used by shared or global pipelines as an authorization exception for modification and deletion operations. An authenticated use...

CVE-2026-105259: Unknown Easy Social Icons: The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file…

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons...

CVE-2026-122318: kyverno: Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and…

Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set th...

TencentOS Server 4: java-17-konajdk (TSSA-2026:1329)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1329 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-117666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer vi...

Fedora 43 : rust-redlib (2026-b6daefd0fc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b6daefd0fc advisory. Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382. This provides added protection against trusting the eMudhra intermediate CA certificates, which...

Rocky Linux 10.2 [CIQ] Security Update: pipewire / pipewire-alsa / pipewire-alsa-debuginfo / etc (crlsa-2026_93442)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202693442 advisory. pipewire: Pulse Server alloca Stack Overflow CVE-2026-14330 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

Fedora 45 : scribus (2026-837d6477fa)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-837d6477fa advisory. 1.6.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but ha...

SUSE SLED15: gvfs / gvfs-backend-afc / gvfs-backend-samba / gvfs-backends / etc (SUSE-SU-2026:5065-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:5065-1 advisory. This update for gvfs fixes the following issue: - CVE-2026-88924: gvfs-admin socket ownership race condition allows loc...

CVE-2026-82910: Improper Neutralization of Special Elements Used in a Template Engine

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

Fedora 43 : python3.15 (2026-5e4931d206)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5e4931d206 advisory. - Update to Python 3.15.2 - CVE 2026-114583: tar filter allows writing outside destination via empty-named symlink - CVE 2026-115557: Distrust compromised...

Fedora 45 : pipx (2026-d521258d12)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d521258d12 advisory. Update to 1.18.12 upstream release, fixing GHSA-jpqf-qh96-2pqf. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 44 : pipx (2026-a1c8629ff7)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a1c8629ff7 advisory. Update to 1.18.12 upstream release, addressing 24 security problems. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 43 : valkey (2026-1fd9c58e29)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1fd9c58e29 advisory. Valkey 8.1.11 - Released Mon 26 October 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible...