CVE-2026-25591 New API has an SQL LIKE Wildcard Injection DoS via Token Search

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause denial of service through resource exhaustion by...

CVE-2026-25591 New API has an SQL LIKE Wildcard Injection DoS via Token Search

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause denial of service through resource exhaustion by...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the token search. An attacker can exhaust system resources and disrupt service availability by submitting specially crafted search patterns containing SQL wildcard...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the token search. An attacker can exhaust system resources and disrupt service availability by submitting specially crafted search patterns containing SQL wildcard...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the token search. An attacker can exhaust system resources and disrupt service availability by submitting specially crafted search patterns containing SQL wildcard...

Oracle Linux 10 : grafana-pcp (ELSA-2026-3035)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-3035 advisory. - Resolves RHEL-146722: CVE-2025-61726 - Resolves RHEL-146927: CVE-2025-61729 Tenable has extracted the preceding description block directly from the...

Oracle Linux 10 : munge (ELSA-2026-3033)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3033 advisory. 0.5.15-11 - Fix CVE-2026-25506 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

CVE-2026-25896

creationtimestamp| type| source ---|---|--- 2026-02-20 04:36:18+00:00| published-proof-of-concept| https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 2026-02-20 21:10:39+00:00| seen| https://gist.github.com/alon710/cde946261b29582f7ad29a1910c52fe6...

AlmaLinux 10 : grafana (ALSA-2026:2914)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2914 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729...

📄 Selenium Server (Grid) 4.27.0 Code Injection

Proof of concept exploit for Selenium Server Grid versions 4.27.0 and below that exploits firefoxprofile to force the browser to run bash commands. ============================================================================================================================================= | Title...

CVE-2025-12343

A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnnbackendtf.c source file. The issue occurs in the dnnexecutemodeltf function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free conditio...

GHSA-97F8-7CMV-76J2

creationtimestamp| type| source ---|---|--- 2026-02-18 18:10:40+00:00| seen| https://gist.github.com/alon710/7d358b16d25392353f6ef386192b3088...

AlmaLinux 10 : gnupg2 (ALSA-2026:2719)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:2719 advisory. GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution CVE-2026-24882 Tenable has extracted the preceding description block...

Mozilla Firefox ESR < 115.32.1

The version of Firefox ESR installed on the remote Windows host is prior to 115.32.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-10 advisory. - Heap buffer overflow in libvpx. This vulnerability affects Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1,...

CVE-2026-20652

creationtimestamp| type| source ---|---|--- 2026-02-13 10:15:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meqbladi3q2h 2026-04-27 00:57:59+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mkguhjp3r22a...

libsoup3 security update

An update is available for libsoup3. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Libsoup is an HTTP library implementation in C. It was originally part of a...

RockyLinux 10 : libsoup3 (RLSA-2026:2410)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:2410 advisory. libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response CVE-2026-1761 Tenable has extracted the preceding description...

AlmaLinux 10 : pcs (ALSA-2026:2438)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:2438 advisory. lodash: prototype pollution in .unset and .omit functions CVE-2025-13465 Tenable has extracted the preceding description block directly from the AlmaLinux securit...

AlmaLinux 10 : libsoup3 (ALSA-2026:2410)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:2410 advisory. libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response CVE-2026-1761 Tenable has extracted the preceding description...

AlmaLinux 10 : kernel (ALSA-2026:2282)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:2282 advisory. kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation CVE-2025-38415 kernel: vsock/vmci: Clear the vmci transport...