Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : libsoup vulnerabilities (USN-8975-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8975-1 advisory. It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote...

CVE-2026-121956: FreeRDP: FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the…

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request who...

Linux Distros Unpatched Vulnerability : CVE-2026-121117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

TencentOS Server 2: libpng12 (TSSA-2026:1362)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1362 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-121256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execut...

Linux Distros Unpatched Vulnerability : CVE-2026-121186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements...

Linux Distros Unpatched Vulnerability : CVE-2026-121254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium...

Security update for perl-MIME-tools (important)

openSUSE security update: security update for perl-mime-tools ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22226-1 Rating: important References: bsc1288714 bsc1288715 bsc1288716 bsc1288717 bsc1288718 bsc1288719 bsc1288720 bsc1288721 bsc1288722...

Linux Distros Unpatched Vulnerability : CVE-2026-121142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy v...

CVE-2026-121748: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

Linux Distros Unpatched Vulnerability : CVE-2026-54878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ofono - None Ubuntu Linux - Unknown description CVE-2026-54878 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-121225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access...

Fedora 44 : mingw-python3 (2026-aa5c18e9be)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-aa5c18e9be advisory. Update to python-3.11.17. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2026-100407: git-for-windows git: Git for Windows is the Windows port of Git

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses scwprintf to size a formatted wide-character credential buffer without space for the terminating NUL whe...

CVE-2026-120632: Inefficient Regular Expression Complexity (ReDoS)

CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary...

CVE-2026-120635: Interpretation Conflict

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some...

CVE-2026-120636: Cross-site Scripting (XSS)

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUESTURI in url and startform. url-absolute=1, url-relative=1 and the default startform action are built from the client-supplied REQUESTURI without validation. The result can be protocol-relative...

CVE-2026-120638: URL Redirection to Untrusted Site ('Open Redirect')

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

CVE-2026-120640: Cross-Site Request Forgery (CSRF)

CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields. CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from th...

CVE-2026-120641: Path Traversal

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can ...