44286 matches found
CVE-2026-113666
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer...
CVE-2026-93150
A flaw was found in the Linux kernel's cgroup/cpuset component. A race condition exists where concurrent modifications to the nrdeadlinetasks variable can lead to its corruption. This corruption can result in incorrect system operations, potentially impacting system stability or availability...
Fedora 44 : iperf3 (2026-c6bdc4b415)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c6bdc4b415 advisory. Update to 3.22. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
Fedora 43 : iperf3 (2026-af72c5c990)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-af72c5c990 advisory. Update to 3.22. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45997)
"In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing putdisk when deviceadd&diskdev fails If deviceadd&sdkp-diskdev fails, putdevice runs scsidiskrelease, which frees the scsidisk but leaves the gendisk referenced. The deviceadddisk error path in sdprobe call...
Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45836)
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2capsockgetsndtimeocb Add the same NULL guard already present in l2capsockresumecb and l2capsockreadycb. This plugin only works with Tenable.ot. Please visit...
CVE-2026-76787
The UpdateHub firmware-over-the-air (FOTA) client in Zephyr is vulnerable to a NULL pointer dereference within the z_impl_updatehub_probe() function. The issue occurs because the JSON decoder treats the sha256sum field as optional; if a network peer omits this string in a CoAP probe response, the...
CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum
The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...
CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum
The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...
ffmpeg-4-4.4.8-6.1 on GA media (moderate)
ffmpeg-4-4.4.8-6.1 on GA media Announcement ID: openSUSE-SU-2026:12064-1 Rating: moderate Cross-References: CVE-2023-6602 CVE-2023-6603 CVE-2024-35367 CVE-2026-18393 CVE-2026-38345 CVE-2026-38346 CVE-2026-38347 CVE-2026-38348 CVE-2026-38349 CVE-2026-38350 CVE-2026-75141 CVSS scores: CVE-2023-6602...
ROOT-OS-DEBIAN-12-CVE-2025-71089 CVE-2025-71089 in linux - Patched by Root
Root has patched CVE-2025-71089 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-46214 CVE-2026-46214 in linux - Patched by Root
Root has patched CVE-2026-46214 in the linux package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2026-46026 CVE-2026-46026 in linux - Patched by Root
Root has patched CVE-2026-46026 in the linux package for Root:Debian:12. Multiple fixed versions available...
Security update for cadvisor (important)
openSUSE security update: security update for cadvisor ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22117-1 Rating: important References: bsc1283657 Cross-References: CVE-2026-63209 CVSS scores: CVE-2026-63209 SUSE : 7.5...
CVE-2026-111907
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...
CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...
CVE-2026-111907
The software phpMyFAQ versions 4.0.0 before 4.1.9 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in the POST /admin/api/update-database endpoint. The root cause is the lack of CSRF token validation when executing database migrations. An attacker can trick a logged-in user poss...
EUVD-2026-103313
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...
CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATIONEDIT permission into submitting a crafted...