Linux Distros Unpatched Vulnerability : CVE-2026-89773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The...

Fedora 46 : ruby (2026-fbf03424ec)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbf03424ec advisory. Update resolv gem in ruby.src to resolve security issues. Tenable has extracted the preceding description block directly from the Fedora security...

CVE-2026-58061

A flaw was found in Bouncy Castle for Java. When using CCM-family Counter with CBC-MAC modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity...

CVE-2026-76977

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76961

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

CVE-2026-76959

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76977

SAP UI5 is affected by a clickjacking vulnerability in its Frame Options Allowlist mechanism. The framework does not sufficiently validate the parent frame's origin against the configured allowlist, allowing an unauthenticated attacker to host a malicious page that bypasses framing restrictions. ...

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

EUVD-2026-72588

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76977 Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...

CVE-2026-76960

SAP S/4HANA Finance (Advanced Payment Management) is affected by a Cross-Site Request Forgery (CSRF) vulnerability caused by insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page; when an authenticated victim interacts with it, uninte...

Security update for ucode-intel (important)

openSUSE security update: security update for ucode-intel ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21736-1 Rating: important References: bsc1265189 bsc1274785 Cross-References: CVE-2025-31936 CVE-2025-31938 CVE-2025-35973 CVE-2025-35979...

Fedora 44 : corosync (2026-e97124c200)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e97124c200 advisory. Fix CVE-2026-81666 and CVE-2026-81665 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

The vulnerability of the unix_stream_bpf_update_proto() function in the net/unix/unix_bpf.c module, which implements networking functions in the Linux operating system’s kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the unixstreambpfupdateproto function in the net/unix/unixbpf.c module, which implements networking functions in the Linux operating system’s kernel, is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an...

Fedora 43 : python-pip (2026-30b4eb25df)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-30b4eb25df advisory. Security fixes for CVE-2026-13346 and CVE-2026-8643 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 43 : mingw-openexr (2026-bcc9ac580d)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bcc9ac580d advisory. Update to openexr 3.4.15 resp 3.3.14. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Injection fast-uri Dependency in Jira Service Management Data Center

This High severity Injection vulnerability was introduced in versions 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2026-83616

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. An attacker can exploit a vulnerability in how processing instructions are handled to inject arbitrary XML structures. This occurs because the software fails to properly validate input, allowing special characters to...

Fedora 44 : hcloud (2026-dd9ec8b0c2)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd9ec8b0c2 advisory. Update to 1.67.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Linux Distros Unpatched Vulnerability : CVE-2026-47885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring...