Linux Distros Unpatched Vulnerability : CVE-2026-121126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-121226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-121240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via crafted netwo...

Linux Distros Unpatched Vulnerability : CVE-2026-121119

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag...

Fedora 44 : mingw-harfbuzz (2026-cb54091d9d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cb54091d9d advisory. Update to 14.6.0 and backport fix for CVE-2026-113679. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : PCRE2 vulnerabilities (USN-8974-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8974-1 advisory. It was discovered that PCRE2 did not correctly manage memory when processing certain...

CVE-2026-108946: Apache Software Foundation: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that user. This allows an authenticated client...

CVE-2026-121802: better-auth Better Auth: @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any…

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes e.g., unauthenticated changes of any account's email address, because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated aft...

CVE-2026-92190: Quest Foglight for Databases: Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution…

Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-121059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross- origin data via a crafted HTML page. Chromium security...

Linux Distros Unpatched Vulnerability : CVE-2026-121062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system acces...

CVE-2026-118403: Unknown Premium Packages: The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before…

The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total...

Fedora 44 : mingw-qt5-qtwebkit (2026-a336a99528)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a336a99528 advisory. Backport fix for CVE-2026-111497. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

CVE-2026-114456: Snowflake: Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have…

Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener...

CVE-2026-120637: Active Debug Code

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...

CVE-2026-120639: HTTP Response Splitting

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches t...

CVE-2026-120645: Inefficient Regular Expression Complexity (ReDoS)

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrollinglist. When rendering option groups, scrollinglist marks the selected options by interpolating each selected value, by default taken from the request parameters,...

CVE-2026-120651: Loop with Unreachable Exit Condition ('Infinite Loop')

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set. When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading...

CVE-2026-122299: jelmer dulwich: Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a…

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

Linux Distros Unpatched Vulnerability : CVE-2026-119776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all prior released versions of FRRouting, the OSPFv3 for IPv6 implementation does not check that OSPFv3 packets have a link-local source address and either a...