Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc (crlsa-2022_1763)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221763 advisory. python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through CVE-2021-43818 Tenable has extracted the preceding description block directly from...

PT-2026-104023

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.0b63 Description Johnson Controls EasyIO FS32 contains a hard-coded cryptographic key, which is a fixed secret used for encryption or decryption. This flaw allows an attacker to retrieve embedded sensitive data...

Rocky Linux 8 [CIQ] Security Update: python-lxml-debugsource / python3-lxml / python3-lxml-debuginfo (crlsa-2022_1932)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221932 advisory. python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through CVE-2021-43818 Tenable has extracted the preceding description block directly from...

CVE-2026-62058: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

AlmaLinux 9.2 [TuxCare] Security Update: java-17-openjdk / java-17-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777645704)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777645704 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affecte...

CVE-2026-102999

A flaw was found in pypdf. An attacker can cause a Denial of Service DoS by supplying a specially crafted PDF document containing a large number of embedded files. When an application accesses the attachment mapping, the library repeatedly reparses the entire attachment list for each lookup. This...

CVE-2026-102999 pypdf: Possible long runtimes with large amount of embedded files

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/doccommon.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when a...

CVE-2026-102999 pypdf: Possible long runtimes with large amount of embedded files

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/doccommon.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when a...

CVE-2026-102999

The pypdf pure-python PDF library is vulnerable to long runtimes when processing a crafted PDF containing a large number of embedded files. Specifically, the dictionary-based attachments API in pypdf/_doc_common.py re-parses the full attachment list for every content lookup, leading to repeated w...

CVE-2026-96342

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83...

EUVD-2026-89773

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83...

CVE-2026-96342

The Amauri.IO WPMobile.App wpappninja WordPress plugin is susceptible to a Missing Authorization vulnerability in versions up to 11.83 . This flaw allows an attacker to Retrieve Embedded Sensitive Data . No specific root cause details, exploitation links, or remediation steps are provided in the ...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-embedded / php-intl / php-mysqlnd / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1746654810)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2025:1746654810 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

CVE-2026-96342: Missing Authorization

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83...

CVE-2026-93764

A flaw was found in Mongoid. When generating the client-side field-level encryption schema, Mongoid may fail to apply encryption rules to fields within embedded models. This oversight can lead to sensitive data, intended for encryption, being stored in plaintext without any indication or error...

CVE-2026-93761

A flaw was found in Mongoid. An inefficient regular expression regex complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated attacker to cause excessive processing within an embedding application. This can lead to a denial of service DoS...

CVE-2026-96750

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

CVE-2026-96750

MongoDB Compass is vulnerable to a shell script injection because it fails to escape database names when interpolating them into the initial input of its embedded MongoDB shell . If a user opens the shell from a specific database's view, an attacker with privileges to create databases on the conn...

CVE-2026-96750 Shell script injection via server-supplied database name in Open MongoDB shell

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have...

CVE-2026-11744 PaperCut Hive Embedded App for Ricoh: Javascript injection

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...