Linux Distros Unpatched Vulnerability : CVE-2026-18393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FFmpeg. The tdscloadcursor function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote...

Linux Distros Unpatched Vulnerability : CVE-2026-81624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certai...

RHEL 9 : iperf3 (RHSA-2026:61389)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61389 advisory. Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter,...

SUSE SLED15 / SLES15 Security Update : go1.25-openssl (SUSE-SU-2026:3815-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3815-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged...

RHEL 10 : nodejs-nodemon (RHSA-2026:61374)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61374 advisory. Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch th...

RockyLinux 9 : libxml2 (RLSA-2026:61247)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61247 advisory. libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-6653 libxml2: libxml2: Arbitrary code execution ...

MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...

Fedora 44 : lego (2026-801a29e61d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-801a29e61d advisory. Update to 5.4.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

F5 Networks BIG-IP : NLnet Labs Unbound vulnerability (K000163141)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163141 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator th...

EUVD-2026-68741

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51684

CVE-2026-51684 is an incorrect access control vulnerability in the setStorageCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can alter the storage-related service state by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No patch or remediat...

EUVD-2026-68580

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

ALSA-2026:61355 Moderate: dbus-broker security update

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features...

UBUNTU-CVE-2026-80641

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 "wifi: wlcore: Add support for IGTK key" lets the amount of ciphers decrease on every boot of a too old...

UBUNTU-CVE-2021-47996

Nokogiri before 1.11.4 CRuby implementation only, when the packaged/vendored libxml2 is used bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream CVE-2019-20388, a global buffer over-read in...

CVE-2026-38347

A heap overflow in the ffswsalphablendaway function libswscale/alphablend.c of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service DoS via a crafted input...

UBUNTU-CVE-2026-18393

A flaw was found in FFmpeg. The tdscloadcursor function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code...

CVE-2026-38344

A NULL pointer dereference in the getminbuffersize function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.16)

The version of AOS installed on the remote host is prior to 7.3.1.16. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.16 advisory. - A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file...

CVE-2025-11001

Uso: root@kitploit: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Explotando 7-zip La vulnerabilidad solo es explotable en Windows y tiene un inconveniente importante. El error solo se puede explotar cuando 7-Zip se ejecuta con privilegios de Administrador para que...