BIT-NODE-MIN-2025-23167

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by...

AlmaLinux 9 : .NET 8.0 (ALSA-2025:7598)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7598 advisory. dotnet: .NET and Visual Studio Spoofing Vulnerability CVE-2025-26646 Tenable has extracted the preceding description block directly from the AlmaLinux security...

AlmaLinux 9 : compat-openssl11 (ALSA-2025:7937)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:7937 advisory. openssl: X.400 address type confusion in X.509 GeneralName CVE-2023-0286 Tenable has extracted the preceding description block directly from the AlmaLinux security...

AlmaLinux 9 : avahi (ALSA-2025:7437)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7437 advisory. avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52616 Tenable has extracted the preceding description block directly from the AlmaLinux security...

AlmaLinux 9 : grafana (ALSA-2025:7404)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7404 advisory. golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 Tenable has extracted the preceding description block directly from...

AlmaLinux 9 : php (ALSA-2025:7431)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7431 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth header...

AlmaLinux 9 : thunderbird (ALSA-2025:7435)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:7435 advisory. thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing CVE-2025-28...

AlmaLinux 9 : vim (ALSA-2025:7440)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7440 advisory. vim: use-after-free in function inscomplgetexp in vim/vim CVE-2023-4752 Tenable has extracted the preceding description block directly from the AlmaLinux security...

AlmaLinux 9 : nodejs:22 (ALSA-2025:7433)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7433 advisory. c-ares: c-ares has a use-after-free in readanswers CVE-2025-31498 SQLite: integer overflow in SQLite CVE-2025-3277 Tenable has extracted the preceding...

RHEL 8 / 9 : Red Hat Ceph Storage 6.1 update (Important) (RHSA-2025:4238)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4238 advisory. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage...

AlmaLinux 9 : webkit2gtk3 (ALSA-2025:7387)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7387 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash CVE-2024-44192 webkitgtk: A malicious website may exfiltrate...

PT-2025-22347 · Isc +3 · Bind 9 +3

Name of the Vulnerable Software and Affected Versions: BIND 9 versions 9.20.0 through 9.20.8 BIND 9 versions 9.21.0 through 9.21.7 Description: When an incoming DNS protocol message includes a Transaction Signature TSIG, BIND always checks it. If the TSIG contains an invalid value in the algorith...

AlmaLinux 9 : firefox (ALSA-2025:8049)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:8049 advisory. firefox: Out-of-bounds access when resolving Promise objects CVE-2025-4918 firefox: Out-of-bounds access when optimizing linear sums CVE-2025-4919 Tenable...

AlmaLinux 9 : yelp (ALSA-2025:7430)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7430 advisory. yelp: Arbitrary file read CVE-2025-3155 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note that Nessus has n...

AlmaLinux 9 : libsoup (ALSA-2025:7436)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7436 advisory. libsoup: Integer overflow in appendparamquoted CVE-2025-32050 libsoup: Heap buffer overflow in sniffunknown CVE-2025-32052 libsoup: Heap buffer overflows ...

AlmaLinux 9 : nginx (ALSA-2025:7402)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7402 advisory. nginx: Memory corruption in the ngxhttpmp4module CVE-2022-41741 nginx: Memory disclosure in the ngxhttpmp4module CVE-2022-41742 nginx: specially crafted M...

AlmaLinux 9 : expat (ALSA-2025:7444)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:7444 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly from t...

CentOS 9 : kernel-5.14.0-585.el9

"The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-585.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted...

AZL-61919 CVE-2025-23166 affecting package nodejs for versions less than 20.14.0-9

The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary...

WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Plugin WHMpress versions = 6.2-revision-9...