AlmaLinux 8 : gstreamer1-plugins-bad-free (ALSA-2025:8201)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8201 advisory. GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2025-3887 Tenable has extracted the preceding descripti...

RHEL 8 : spice-client-win (RHSA-2025:8219)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8219 advisory. Spice client MSI installers for Windows clients Security Fixes: freetype: OOB write when attempting to parse font subglyph structures related to...

RHEL 8 : webkit2gtk3 (RHSA-2025:8066)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8066 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: Processing maliciously...

RHEL 8 : yelp and yelp-xsl (RHSA-2025:7569)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7569 advisory. Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including...

RHEL 8 : kernel-rt (RHSA-2025:7532)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7532 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

RHEL 8 : mingw-freetype and spice-client-win (RHSA-2025:8195)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8195 advisory. MinGW Windows Freetype library. Security Fixes: freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and...

Oracle Linux 8 : gstreamer1-plugins-bad-free (ELSA-2025-8201)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8201 advisory. 1.16.1-5.0.1 - Update origin URL Orabug: 36209826 1.16.1-5 - fix for CVE-2025-3887 Resolves: RHEL-93051 Tenable has extracted the preceding description block...

RHEL 8 : kernel-rt (RHSA-2025:7902)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7902 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

AlmaLinux 8 : libsoup (ALSA-2025:8132)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:8132 advisory. libsoup: Heap buffer over-read in skipinsignificantspace when sniffing content CVE-2025-2784 libsoup: Denial of Service attack to websocket server...

Oracle Linux 8 : libsoup (ELSA-2025-8132)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-8132 advisory. 2.62.3-9 - Add patches to improve test reliability - Backport patches for various CVEs Resolves: RHEL-85879 Resolves: RHEL-92280 Resolves: RHEL-93031...

Fedora 41 : ghostscript (2025-d5e2376a90)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-d5e2376a90 advisory. CVE-2025-46646 ghostscript: Mishandling of Overlong UTF-8 Encoding in decodeutf8 fedora2362639, fedora2362446 Tenable has extracted the preceding...

CVE-2024-45200

In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based buffer overflow upon deserialization of session information via a malformed browse-reply packet, aka KartLANPwn. The victim is not required to join a game...

CVE-2024-29276

An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component...

CVE-2024-54134

A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...

CVE-2024-24425

Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amfasestablishreq function at /tasks/amf/amfas.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted NAS packet...

CVE-2023-41784

Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro...

CVE-2023-23898

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in CreativeThemes Blocksy Companion plugin = 1.8.67 versions...

CVE-2023-0480

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. This is possible because the application is vulnerable to CSRF...

CVE-2023-46943

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens JWTs, allowing them access t...

CVE-2022-45853

The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70AAHH.3 and the GS1900-8HP firmware version V2.70AAHI.3 could allow an authenticated, local attacker with administrator privileges to execute some system commands as 'root' on a vulnerable device via SSH...