19113 matches found
PT-2026-55583
Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote attacker can send a specifically crafted message to downgrade the Transport Layer Security TLS protocol to a version that has been disabled in the server configuration. This issue involves th...
The vulnerability of the 7z-file processing mechanism of the ClamAV antivirus program allows a hacker to trigger a service failure.
The vulnerability of the 7z-file processing mechanism of the ClamAV antivirus program lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a specially crafted file...
Oracle Linux 8 : php:7.4 (ELSA-2026-34354)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-34354 advisory. - Fix XSS within status endpoint CVE-2026-6735 - Fix Stale SOAPGLOBALrefmap pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after header...
Fedora 44 : 7zip (2026-948b74882b)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-948b74882b advisory. 7-zip 26.02 - Some bugs and vulnerabilities were fixed. Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...
Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-88cFYyxR)
According to its self-reported version, Cisco Secure Endpoint is affected by multiple vulnerabilities. - A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...
Fedora 45 : rust-fern / rust-ifcfg-devname / rust-routinator / rust-rpki / etc (2026-188f731254)
The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-188f731254 advisory. Update routinator to the latest, pulling in updated dependencies rpki and syslog, and switch fern to using syslog 7 instead of 6 for this update, an...
7-Zip <= 26.02 Mark-of-the-Web Bypass (CVE-2026-58052)
The version of 7-Zip installed on the remote Windows host is 26.02 or earlier. It is, therefore, affected by a vulnerability: - 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier...
openSUSE 16: ffmpeg-7 / ffmpeg-7-libavcodec-devel / ffmpeg-7-libavdevice-devel / etc (openSUSE-SU-2026:21211-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21211-1 advisory. This update for ffmpeg-7 fixes the following issues - CVE-2026-40962: inadequate CENC subsample bounds checks can lead to an integer overflow...
Security update for ffmpeg-7 (moderate)
openSUSE security update: security update for ffmpeg-7 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21211-1 Rating: moderate References: bsc1220545 bsc1234030 bsc1237561 bsc1249393 bsc1249431 bsc1262237 Cross-References: CVE-2023-6601...
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
Summary A stored Cross-Site Scripting XSS vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as optio...
EUVD-2026-33280
Mautic has Stored Cross-Site Scripting XSS in Project Option Selector...
GHSA-7H65-WHP7-RGQF Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
Summary A stored Cross-Site Scripting XSS vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views such as campaigns, emails, or forms, user-supplied project names are rendered without proper sanitization. An authenticate...
GHSA-3VCG-PV95-PQ54 SFTPGo has stored XSS via inline parameter on public shares and user file download
Summary The inline query parameter on the browsable-share file download and on the authenticated user file download suppressed Content-Disposition: attachment, so an HTML file stored in a share or home directory could be served as text/html and execute in SFTPGo's web origin stored XSS. Impact Lo...
GHSA-H64P-8H4R-6GFH SFTPGo has path confinement bypass in public browsable share partial ZIP download
Summary The public web-client endpoint for partial ZIP downloads of a browsable share did not correctly confine the client-supplied files entries to the shared directory. A requester able to reach a public share could read files located outside the shared directory, as long as the target's...
Openstack tripleo-heat-templates unauthenticated file access
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...
PYSEC-2026-754 Openstack tripleo-heat-templates unauthenticated file access
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thu...
CVE-2026-57689
Subscriber Broken Access Control in Werkstatt = 4.7.2 versions...
CVE-2026-57690
Unauthenticated Cross Site Request Forgery CSRF in Werkstatt = 4.7.2 versions...