MiracleLinux 7 : tomcat-7.0.76-16.0.1.el7.AXS7 (AXSA:2024-8731:12)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8731:12 advisory. Fix file path bug introduced by the CVE-2021-25329 fix CVEs: CVE-2021-25329 The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to...

MiracleLinux 8 : tomcat-9.0.62-27.el8 (AXSA:2024-7363:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7363:01 advisory. Apache Commons FileUpload: FileUpload DoS with excessive parts CVE-2023-24998 tomcat: not including the secure attribute causes information disclosu...

MiracleLinux 9 : pam-1.5.1-26.el9_6 (AXSA:2025-10831:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10831:06 advisory. linux-pam: Linux-pam directory Traversal CVE-2025-6020 linux-pam: Incomplete fix for CVE-2025-6020 CVE-2025-8941 Tenable has extracted the precedin...

EUVD-2026-2935

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass...

MiracleLinux 7 : libvirt-3.9.0-14.el7.4 (AXSA:2018-3092:06)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3092:06 advisory. libvirt: Resource exhaustion via qemuMonitorIORead method CVE-2018-5748 libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent...

MiracleLinux 4 : libvirt-0.10.2-64.0.1.AXS4 (AXSA:2018-3226:03)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3226:03 advisory. libvirt: Resource exhaustion via qemuMonitorIORead method CVE-2018-5748 libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent...

CVE-2026-22864 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001986)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001986 advisory. Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002038)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002038 advisory. Race condition in the rdssendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service NULL pointer...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001857)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001857 advisory. The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNELDS option is set, which allows local...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002354)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002354 advisory. Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003320)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003320 advisory. In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket. This issue...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003479 advisory. Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent...

CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

CVE-2026-23492

Pimcore Admin Search Find API exposes blind SQL injection due to an incomplete patch from CVE-2023-30848. Affected versions: Pimcore before 12.3.1 and before 11.5.14. Attack requires authenticated access to the admin interface and can disclose database information via blind SQL injection, potenti...

CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001187)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001187 advisory. The simplesetacl function in fs/posixacl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allow...

MiracleLinux 9 : tomcat-9.0.87-3.el9_6.1 (AXSA:2025-10690:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10690:04 advisory. tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation CVE-2024-56337 tomcat: Apache Tomcat: DoS via malformed HTTP...

Atlassian Confluence 7.19.0 < 8.5.20 / 8.6.x < 9.2.6 / 9.3.x < 9.3.1 / 9.4.0 / 9.5.x < 9.5.2 / 10.0.x < 10.0.2 / 10.1.0 / 10.2.0 (CONFSERVER-101489)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101489 advisory. - The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and...

CVE-2018-1000118

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to hav...