Tenable Security Center < 6.9.0 Multiple Vulnerabilities (TNS-2026-22)

According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-22 advisory. - libcurl might in some circumstances reuse the wrong connection for SMBS transfers...

CVE-2026-7808 justhtml before 1.16.0 Multiple Security Issues via Sanitization

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content e.g., script or style to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML..., sanitize=Tru...

AZL-97068 CVE-2026-74622 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

Linux Distros Unpatched Vulnerability : CVE-2026-77220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the...

CVE-2026-77761

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused. Several STIX 1 and STIX 2 parser components maintained...

CVE-2026-77761

misp-stix is a Python library for converting STIX documents to MISP events. A parser state isolation flaw allows per-document state (galaxies, galaxy clusters, passive DNS records, references, package titles, dates, and timestamps) to persist across conversions when the same parser instance is re...

CVE-2026-77761 Cross-Document Parser State Contamination in misp-stix

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused. Several STIX 1 and STIX 2 parser components maintained...

EUVD-2026-63883

A parser state isolation vulnerability in misp-stix could cause data from a previously processed STIX document to be retained and incorporated into the MISP event generated from a subsequent document when the same parser instance is reused. Several STIX 1 and STIX 2 parser components maintained...

CVE-2026-46355

BigBlueButton prior to 3.0.23 exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through a routable controller action in ApiController.groovy rather than a private helper. An authenticated requester who could supply the existingUserID of an active participant was able to reuse that pa...

curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse

cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse...

USN-8651-1 curl vulnerability

It was discovered that curl incorrectly handled reusing connections when the origin changed between transfers. A remote attacker could possibly use this issue to obtain sensitive information...

USN-8651-1: curl vulnerability

It was discovered that curl incorrectly handled reusing connections when the origin changed between transfers. A remote attacker could possibly use this issue to obtain sensitive information...

CVE-2026-63408

In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...

curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials

A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...

curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker...

libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...

curl: Information disclosure due to uncleared proxy authentication state

A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...