GHSA-M4P7-R5RC-7G4J vulnerabilities

Vulnerabilities for packages: superset, mlflow, py3-cassandra-medusa, airflow, kubeflow-pipelines, kserve...

Fedora 44 : curl (2026-e691fbbfe7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e691fbbfe7 advisory. - Fix trailing dot domain super cookie CVE-2026-8924 - Fix SSH improper host validation CVE-2026-9547 - Fix password leak with netrc and user in URL...

Fedora 44 : gh (2026-4e77362489)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e77362489 advisory. Update to 2.97.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Linux Distros Unpatched Vulnerability : CVE-2026-67355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as...

Linux Distros Unpatched Vulnerability : CVE-2026-67354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting...

Linux Distros Unpatched Vulnerability : CVE-2026-67338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-67316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate...

libntpc1-1.2.5-1.1 on GA media (moderate)

libntpc1-1.2.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11417-1 Rating: moderate Cross-References: CVE-2026-18321 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the libntpc1-1.2.5-1....

gio-branding-upstream-2.88.3-1.1 on GA media (moderate)

gio-branding-upstream-2.88.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11415-1 Rating: moderate Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2026-15588 SUSE : 4.8...

OPENSUSE-SU-2026:11436-1 golang-github-prometheus-prometheus-3.13.2-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 43 : nextcloud (2026-51116fe081)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51116fe081 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

CVE-2026-59884 vulnerabilities

Vulnerabilities for packages: mlflow, datahub-ingestion, wazuh-manager-fips, py3-cassandra-medusa, authentik-fips, duplicity, kserve, airflow, openstack-keystone-2026.1, superset, openstack-keystone-2025.1, openstack-keystone-2025.2, kubeflow-pipelines, wazuh-manager, localstack,...

GHSA-M4P7-R5RC-7G4J vulnerabilities

Vulnerabilities for packages: mlflow, datahub-ingestion, wazuh-manager-fips, py3-cassandra-medusa, authentik-fips, duplicity, kserve, airflow, openstack-keystone-2026.1, superset, openstack-keystone-2025.1, openstack-keystone-2025.2, kubeflow-pipelines, wazuh-manager, localstack,...

CVE-2026-54787 vulnerabilities

Vulnerabilities for packages: goreleaser, trivy, tkn, kyverno-notation-aws, policy-controller, ko, zot, flux-source-controller, zarf, kyverno, aactl, kubescape, spire-server, falcoctl, trivy-operator, skaffold, tekton-chains, neuvector-sigstore-interface, crossplane...

GHSA-WQQC-JJCQ-VFXM vulnerabilities

Vulnerabilities for packages: goreleaser, trivy, tkn, kyverno-notation-aws, policy-controller, ko, zot, flux-source-controller, zarf, kyverno, aactl, kubescape, spire-server, falcoctl, trivy-operator, skaffold, tekton-chains, neuvector-sigstore-interface, crossplane...

GHSA-WG4G-WM44-CH5J vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, rke2-runtime, livekit-egress, kubo-fips, spegel-fips, kubo, rke2-runtime-fips, telegraf, ipfs-cluster, spegel, k3s...

CVE-2026-54909 vulnerabilities

Vulnerabilities for packages: ipfs-cluster-fips, rke2-runtime, livekit-egress, kubo-fips, spegel-fips, stunnerd, kubo, rke2-runtime-fips, ipfs-cluster, op-geth, spegel, k3s...

MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.1.hum1 aarch64, x8664 tar-1.35-9.1.hum1.src src Security Fixes: tar: CVE-2026-18477...