ROS-20260928-73-0124

The vulnerability of the nfs4setupreaddir function in the fs/nfs/nfs4proc.c module, which is part of the NFS client support in Linux kernel, relates to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility o...

ROS-20260928-73-0125

The vulnerability of the udptunnelnicnetdeviceevent function in the net/ipv4/udptunnelnic.c module of the Linux kernel’s IPv4 protocol implementation is related to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability could allow an attacker to...

ROS-20260928-73-0047

The vulnerability of the xfrmstatedeletetunnel function in the net/xfrm/xfrmstate.c module of the Linux kernel is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Atlassian Confluence 8.9.x < 9.2.24 / 9.3.x < 10.2.17 (CONFSERVER-104443)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104443 advisory. - In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java L...

Exposure of Resource to Wrong Sphere

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the bufferFrom and related Buffer factory functions in lib/setup-sandbox.js, where Node.js serves small...

CVE-2026-100833

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2025-71424

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2026-100833

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 are vulnerable to container image substitution due to a flawed runtime policy generation. A regression in a Kata Containers update introduced an allow_storage rule that accepts storage entries using the image_guest_pull driver without ...

EUVD-2026-87853

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2026-100833 Contrast before 1.23.1 Image Substitution via Policy Generation

Contrast edgelesssys/contrast versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an allowstorage rule that accepts storage entries using the imageguestpull driver witho...

CVE-2025-71424

Edgeless Systems Contrast versions up to and including 1.9.0 are vulnerable to an insecure volume mount issue. In bare-metal deployments, the containerd runtime adds a mount point for VOLUME directives defined in a Dockerfile when Kubernetes sets none. This allows an untrusted host to write arbit...

EUVD-2025-211008

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

CVE-2025-71424 Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile config.volumes in the OCI image configuration is only a hint and is not handled specially by Kubernetes, but containerd adds a mou...

Fedora 43 : mingw-python3 (2026-9359fb439f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9359fb439f advisory. Update to python-3.11.16. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Use of Less Trusted Source

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Less Trusted Source via incomplete propagation of revision and coderevision pins across artifact boundaries in the model loader subsystem. Wh...

CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100653

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...