CVE-2026-91202: UNIX Symbolic Link (Symlink) Following

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

CVE-2026-91203: Race Condition Enabling Link Following

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

PT-2026-95586

Name of the Vulnerable Software and Affected Versions cockpit-machines affected versions not specified Description A flaw in the cockpit-machines component allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords. This occurs because the component...

PT-2026-95634

Name of the Vulnerable Software and Affected Versions cockpit-files versions prior to 44-1.1 Description A flaw in the "Paste as owner" function allows a low-privileged local user to change arbitrary file ownership outside the intended directory. This is achieved by crafting a directory containin...

CVE-2026-93689: NULL Pointer Dereference

WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing...

CVE-2024-27123: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later...

PT-2026-95635

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A timing issue, known as a symlink race condition, exists during privileged file operations such as changing file ownership or permissions. A local attacker can manipulate directory...

Fedora 44 : sblim-cmpi-base (2026-7510dd645d)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7510dd645d advisory. Use mktemp for temporary files in provider registration script CVE-2026-73585 Tenable has extracted the preceding description block directly from th...

Fedora 44 : freeciv (2026-3b9c14cd66)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b9c14cd66 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

EulerOS Virtualization 2.11.0 : dnsmasq (EulerOS-SA-2026-3497)

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with R...

EulerOS Virtualization 2.12.0 : gzip (EulerOS-SA-2026-3642)

According to the versions of the gzip package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global stat...

Fedora 45 : freeciv (2026-6fe2310246)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6fe2310246 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

Fedora 43 : freeciv (2026-75bde5d061)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-75bde5d061 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

Linux Distros Unpatched Vulnerability : CVE-2026-92474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component...

Linux Distros Unpatched Vulnerability : CVE-2026-92473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gfsgcommanddel of the file src/scenegraph/commands.c of the component BIF...

EulerOS Virtualization 2.11.1 : libtiff (EulerOS-SA-2026-3436)

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file...

Fedora 43 : stb (2026-0cae436fa5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0cae436fa5 advisory. Patch stbsprintf: security fix for CVE-2026-79516 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

EulerOS Virtualization 2.11.0 : libtiff (EulerOS-SA-2026-3523)

According to the versions of the libtiff packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the fil...

Microsoft Edge (Chromium) < 153.0.4234.48 (CVE-2026-88097)

The version of Microsoft Edge installed on the remote Windows host is prior to 153.0.4234.48. It is, therefore, affected by a vulnerability as referenced in the September 18, 2026 advisory. - Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to elevate privileges...

EulerOS Virtualization 2.11.1 : binutils (EulerOS-SA-2026-3403)

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malform...