CVE-2026-108048: AM System ALO Suite: Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call...

CVE-2026-111751: angular: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 21.2.0 until 21.2.25 and 22.2.1, RouterLink directives rendered during Node.js server-side rendering retain computed UrlTree instances for the lifetime of each...

CVE-2026-121086: Google Chrome: Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121138: Google Chrome: Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin…

Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121218: Google Chrome: Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Fedora 45 : erlang-hex_core (2026-b514ab4cac)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b514ab4cac advisory. hexcore ver. 0.21.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

FreeBSD : freenginx -- TLS session ticket key left uninitialized (4784aba5-d6a9-11f1-8a93-a0369f6e85b8)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4784aba5-d6a9-11f1-8a93-a0369f6e85b8 advisory. The freenginx project reports: One of the keys was left uninitialized when using automatic rotation of...

Fedora 44 : glib-networking (2026-f9c9c98abe)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f9c9c98abe advisory. Fixes CVE-2026-103963 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Kibana 8.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Incorrect Authorization (ESA-2026-203)

The version of Kibana installed on the remote host is 8.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-203 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana Machine...

Kibana 8.7.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Incorrect Authorization (ESA-2026-206)

The version of Kibana installed on the remote host is 8.7.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-206 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead t...

Logstash 8.12.1 < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 Multiple Vulnerabilities (ESA-2026-228)

The version of Logstash installed on the remote host is 8.12.1 or later prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-228 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for...

Langflow 1.0.x < 1.13.0 Multiple Vulnerabilities

The version of Langflow installed on the remote host is 1.0.x prior to 1.13.0. It is, therefore, affected by multiple vulnerabilities: - IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. CVE-2026-93680 - IBM Langflo...

Rocky Linux 8.6 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (ciqsa-2026_1750)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261750 advisory. This advisory aggregates security fixes for the dotnet6.0 SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2026-111497. Tenable has extracted the preceding descriptio...

Photon OS 5.0: Linux PHSA-2024-5.0-90-0305

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-90-0305. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 10 : podman (ELSA-2025-23295)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-23295 advisory. - rebuild for CVE-2025-58183 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

CVE-2026-121396: FreeRDP: FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in…

FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rtsreadauthverifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP RTS PDU with inconsistent authentication padding to abort the...

CVE-2026-121732: francoisjacquet RosarioSIS: RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to…

RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student POST array of a...

RHEL 9 : fence-agents (RHSA-2026:94523)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94523 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or...

RHEL 8 : libXtst (RHSA-2026:94567)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94567 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...

RHEL 8 : libXtst (RHSA-2026:94482)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94482 advisory. X.Org X11 libXtst runtime library Security Fixes: libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser CVE-2026-94286 F...