FreeBSD : security/wolfssh -- multiple vulnerabilities (61a6b109-d852-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 61a6b109-d852-11f1-bae2-3497f65b111b advisory. wolfSSL reports: Tenable has extracted the preceding description block directly from the FreeB...

Fedora 44 : valkey (2026-5aaf7130ef)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5aaf7130ef advisory. Valkey 9.0.7 - Released Mon 26 October 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible. Securi...

SUSE SLES15 Security Update : curl (SUSE-SU-2026:5069-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5069-1 advisory. - CVE-2026-8932: incomplete mTLS config matching in conn reuse bsc1268414. - CVE-2026-9546: sending old referer bsc1268419. -...

Fedora 45 : valkey (2026-3bb241ef05)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3bb241ef05 advisory. Valkey 8.0.12 - Released Mon 26 October 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible...

Fedora 44 : ruby-build (2026-62de4e63a0)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-62de4e63a0 advisory. Update to 20261023 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2026-122319: kyverno: Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to…

Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types,...

Rocky Linux 9.2 [CIQ] Security Update: pmix / pmix-devel / pmix-pmi / pmix-pmi-devel / pmix-tools (ciqsa-2026_1757)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261757 advisory. This advisory aggregates security fixes for the pmix SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2023-41915. Tenable has extracted the preceding description bloc...

openSUSE 16: libosmocodec-devel / libosmocodec4 / libosmocoding-devel / etc (openSUSE-SU-2026:22220-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22220-1 advisory. Changes in libosmocore: - Update to release 1.14.2 Fix buffer overflows/overreads in bssgprxpaging, parseprocessussreq, osmodecgcr, osmopbit2ubi...

CVE-2026-123036: Red Hat ansible-core: A flaw was found in ansible-core

A flaw was found in ansible-core. When a task marked nolog: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...

Rocky Linux 8 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc (crlsa-2026_93978)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202693978 advisory. ghostscript: Reintroduction of .charkeys -dSAFER bypass in Rocky Linux 8 CVE-2026-112177 Tenable has extracted the preceding description block directly from the CI...

SUSE SLES15: apache2 / apache2-devel / apache2-manual / apache2-prefork / etc (SUSE-SU-2026:5075-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5075-1 advisory. - CVE-2026-42356: deployment of wrong handler allows target of internal redirects from CGI programs to also be treated as CGI and...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1793864778)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793864778 advisory. - libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XMLParserReset zeroes the direct byte count but never offse...

CVE-2026-100144: Unknown IVPAY payments: The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it…

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

CVE-2026-107774: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted…

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather tha...

CVE-2026-63217: SuiteCRM: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean without checking the requesting user's record access. The affected flow begins at...

CVE-2026-73101: Apache Software Foundation Apache Juneau: Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when...

CVE-2026-68524: Code Injection

An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which...

CVE-2026-54140: tinyhumansai openhuman: OpenHuman is an open-source agent harness available as a desktop application and Rust library

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or...

CVE-2026-82912: Improper Neutralization of Special Elements used in an Expression Language Statement

Improper Neutralization of Special Elements Used in an Expression Language Statement 'Expression Language Injection' in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and ACCOUNTINGVIEW, the two view-level...

CVE-2026-81808: Missing Authorization

Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product searc...