1141893 matches found
Security Update for Microsoft .NET Core SDK (September 2026)
The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges ove...
Fedora 45 : bluez (2026-84b4f1c43a)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-84b4f1c43a advisory. BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP X...
PT-2026-89806
Dell patched critical Dell ObjectScale vulnerabilities, led by CVE-2026-70416. Fix these Dell ObjectScale vulnerabilities to stop remote code execution. DellObjectScale Cybersecurity CVE202670416 Vulnerabilities InfoSec https://t.co/MLbycde9pc https://t.co/1t9Iir3uo7...
Fedora 43 : dokuwiki (2026-046b69d591)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-046b69d591 advisory. Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752 Tenable has extracted the preceding description block directly from...
Adobe Commerce B2B Arbitrary Code Execution (APSB26-146)
The version of the Adobe Commerce B2B module installed on the remote host is affected by a vulnerability as referenced in the APSB26-146 advisory. - Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary...
Security Updates for Azure CLI (September 2026)
The Microsoft Azure CLI installation on the remote host is missing a security update. It is, therefore, affected by a command injection vulnerability: - Improper neutralization of special elements used in a command 'command injection' in Microsoft Azure CLI allows an authorized attacker to execut...
Linux Distros Unpatched Vulnerability : CVE-2026-71614
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c,...
RockyLinux 9 : perl-DBI (RLSA-2026:66179)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66179 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...
Microsoft Edge (Chromium) < 152.0.4191.66 Multiple Vulnerabilities
The version of Microsoft Edge installed on the remote Windows host is prior to 152.0.4191.66. It is, therefore, affected by multiple vulnerabilities as referenced in the September 11, 2026 advisory. - Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
AlmaLinux 9 : nginx (ALSA-2026:66542)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:66542 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...
org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge
A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...
CVE-2026-84889
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-84889
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-81940
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...
CVE-2026-82095
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...