SUSE SLES15: kubernetes1.33-client / kubernetes1.33-client-bash-completion / etc (SUSE-SU-2026:3823-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3823-1 advisory. This update for kubernetes-old rebuilds it against the current go security release. Tenable has extracted the preceding description block...

Fedora 43 : rpki-client (2026-52e9ee2c4d)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-52e9ee2c4d advisory. rpki-client 9.9 - Introduce a backoff retry mechanism for non-functional CAs, eventually settling on retrying broken CAs only once per day. Backoff helps...

Linux Distros Unpatched Vulnerability : CVE-2026-18703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based...

Debian dla-4763 : amqp-tools - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4763 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4763-1 [email protected]...

RHEL 8 : libXfont2 (RHSA-2026:61755)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61755 advisory. X.Org X11 libXfont2 runtime library Security Fixes: libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679...

Linux Distros Unpatched Vulnerability : CVE-2026-33245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components RSC APIs, there is a potential...

SUSE SLES15: kubernetes1.35-client / kubernetes1.35-client-bash-completion / etc (SUSE-SU-2026:3824-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3824-1 advisory. This update for kubernetes rebuilds it against the current go security release. Tenable has extracted the preceding description block direct...

Fedora 44 : rpki-client (2026-fb17adc9de)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fb17adc9de advisory. rpki-client 9.9 - Introduce a backoff retry mechanism for non-functional CAs, eventually settling on retrying broken CAs only once per day. Backoff helps...

OESA-2026-3567 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...

OESA-2026-3566 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...

OESA-2026-3565 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. This outcome occurs only on the client side.CVE-2026-60002...

PT-2026-84854

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: An unknown vulnerability exists in QEMU, with no detailed description available at this time.CVE-2026-15264 CVE-2026-16457 is a security vulnerability in QEMU. The specific details of thi...

OPENSUSE-SU-2026:11647-1 httpcomponents-client-4.5.14-2.1 on GA media

These are all security issues fixed in the httpcomponents-client-4.5.14-2.1 package on the GA media of openSUSE Tumbleweed...

4591-libs (>=0.0.1, <=0.2.0), @0x0bit/sails-hook-redis (>=0.1.1, <=0.1.2) +3729 more potentially affected by CVE-2026-82562 via qs (>=6.14.2, <=6.15.3)

qs NPM version =6.14.2, =0.0.1, =0.1.1, =0.1.1, =0.0.1-alpha.29, =0.1.6-alpha.11, =0.0.1-alpha.20, =1.0.5, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4 and more Source cves: CVE-2026-82562 Source advisory: MEND:CVE-2026-82562...

CVE-2026-82463

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks...

CVE-2026-82462 pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulti...

Improper Certificate Validation

org.mariadb.jdbc:mariadb-java-client is vulnerable to Improper Certificate Validation. The vulnerability is due to improper certificate fingerprint validation during the initial TLS handshake, which allows an active man-in-the-middle attacker or malicious server to present a self-signed certifica...

Malicious Package

Overview analytics-web-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ux-metrics-client-interaction-subscriber is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...