1141862 matches found
Fedora 43 : dokuwiki (2026-046b69d591)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-046b69d591 advisory. Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752 Tenable has extracted the preceding description block directly from...
Security Updates for Azure CLI (September 2026)
The Microsoft Azure CLI installation on the remote host is missing a security update. It is, therefore, affected by a command injection vulnerability: - Improper neutralization of special elements used in a command 'command injection' in Microsoft Azure CLI allows an authorized attacker to execut...
PT-2026-89806
Dell patched critical Dell ObjectScale vulnerabilities, led by CVE-2026-70416. Fix these Dell ObjectScale vulnerabilities to stop remote code execution. DellObjectScale Cybersecurity CVE202670416 Vulnerabilities InfoSec https://t.co/MLbycde9pc https://t.co/1t9Iir3uo7...
Security Update for Microsoft .NET Core SDK (September 2026)
The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges ove...
Security Update for Microsoft .NET Core (September 2026)
The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a...
RockyLinux 9 : perl-DBI (RLSA-2026:66179)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66179 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...
org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge
A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...
CVE-2026-84889
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-84889
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-82095
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-81940
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...
CVE-2026-82097
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery SSRF vulnerability...
CVE-2026-82099
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-81550
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...
CVE-2026-81204
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction...