Fortinet FortiSIEM 7.4.1 <= 7.4.2 / 7.5.0 <= 7.5.1 Open Redirect (FG-IR-26-169)

The version of Fortinet FortiSIEM running on the remote host is 7.4.1 through 7.4.2, or 7.5.0 through 7.5.1. It is, therefore, affected by a URL redirection to untrusted site vulnerability: - A URL redirection to untrusted site 'open redirect' vulnerability in Fortinet FortiSIEM may allow an...

MiracleLinux 9 : nginx:1.26 (AXSA:2026-1869:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1869:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

CVE-2026-54734: Server-Side Request Forgery (SSRF)

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can...

CVE-2026-92566

DataGear through 6.0.0 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /dataSet/preview/Http endpoint. By supplying a caller-controlled URI, an attacker can issue GET, POST, PUT, PATCH, or DELETE requests to internal services and cloud metadata endpoints, recei...

PT-2026-94023

A server-side request forgery SSRF vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable onl...

PT-2026-93811

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 6.0.1 Description An issue exists where unauthenticated attackers can execute arbitrary HTTP requests by providing a caller-controlled URI. This occurs via the '/dataSet/preview/Http' endpoint, allowing the issuance ...

CVE-2026-92808: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable onl...

CVE-2026-78252: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

AlmaLinux 9 : nginx:1.26 (ALSA-2026:67283)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67283 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

MiracleLinux 9 : nginx:1.24 nginx-1.24.0-7.module+el9+1196+3855d771.5.ML.1 (AXSA:2026-1851:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1851:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : nginx:1.24 nginx-1.24.0-3.module+el8+2045+adfc96b2.5.ML.1 (AXSA:2026-1852:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1852:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

CVE-2026-68953

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

CVE-2026-68953 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

nginx security update

An update is available for nginx. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other protocols, with a...

RLSA-2026:67314 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

PT-2026-93121

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authentication bypass allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by...

ROS-20260915-73-0146

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted HTML page...

RockyLinux 10 : nginx (RLSA-2026:67314)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLin...

AlmaLinux 8 : nginx:1.24 (ALSA-2026:67315)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67315 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

ROS-20260915-73-0053

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...