CVE-2026-115473: cesanta mongoose: Mongoose is an embedded web server and network library

Mongoose is an embedded web server and network library. Prior to 7.22, mgpathissane in src/util.c read path.buf1 without first requiring path.len to be at least two and read s2 when only two bytes remained. Unauthenticated remote requests reaching mghttpupload or mghttpservedir with the affected...

CVE-2026-57567: readest: Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading…

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transferfile.rs commands downloadfile and uploadfile accepted a webview-controlled...

CVE-2025-71456: vtenext: vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject…

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2026-97705: moleculerjs moleculer: Moleculer is a progressive microservices framework for Node.js

Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser.write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.sliceleng...

CVE-2026-76826: tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAWRELEASE.md. Contributor-controlled shell...

CVE-2026-122120: Yealink Plug-in Softwares: In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific…

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution...

CVE-2026-121147: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this...

Security update for perl-MIME-tools (important)

openSUSE security update: security update for perl-mime-tools ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22226-1 Rating: important References: bsc1288714 bsc1288715 bsc1288716 bsc1288717 bsc1288718 bsc1288719 bsc1288720 bsc1288721 bsc1288722...

AlmaLinux 9.2 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / etc (ALMALINUX9.2:CLSA-2026:1793783172)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793783172 advisory. - Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a...

CVE-2026-100302: Apache Software Foundation Apache ZooKeeper: Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a…

Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server denial of service with a single small request. The multiRead handler places no limit on the number of bundled read operations or on the cumulative...

CVE-2026-102704: Xen: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches...

OpenJDK 8 <= 8u372 / 11.0.0 <= 11.0.19 / 17.0.0 <= 17.0.7 / 20.0.0 <= 20.0.1 Multiple Vulnerabilities (2023-07-18)

The version of OpenJDK installed on the remote host is 8 prior to or at 8u372 / 11.0.0 prior to or at 11.0.20 / 17.0.0 prior to or at 17.0.8 / 20.0.0 prior to or at 20.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023-07-18 advisory. Please Note: Java CVEs do n...

TencentOS Server 4: kernel (TSSA-2026:1343)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1343 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-87043: zephyrproject zephyr: The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from…

The entropy-device random number generator in subsys/random/randomentropydevice.c returned early with -ENODEV from randget as soon as deviceisready failed, before reaching the non-cryptographic system-timer fallback further down the same function. Because zimplsysrandget returns void and discards...

Linux Distros Unpatched Vulnerability : CVE-2026-120650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX...

Fedora 43 : python3.9 (2026-37bcaf6ef8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-37bcaf6ef8 advisory. - Security fix for CVE-2026-11940 - Security fix for CVE-2026-15308 Tenable has extracted the preceding description block directly from the Fedora...

Linux Distros Unpatched Vulnerability : CVE-2026-54880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ofono - None Ubuntu Linux - Unknown description CVE-2026-54880 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-121400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending ...

Linux Distros Unpatched Vulnerability : CVE-2026-119741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hashsearch in match.c that allows malicious receivers to trigger...

Linux Distros Unpatched Vulnerability : CVE-2026-121177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page...