PT-2026-5354

Name of the Vulnerable Software and Affected Versions malcontent versions 1.8.0 through 1.20.2 Description malcontent may allow for the creation of symlinks outside the intended extraction directory when scanning specially crafted tar or deb archives. This occurs because the handleSymlink functio...

vCluster Platform security vulnerabilities

vCluster Platform is an open-source virtual cluster manager developed by vCluster. Vulnerabilities existed in versions prior to vCluster Platform 4.6.0, 4.5.4, 4.4.2, and 4.3.10. These vulnerabilities were due to a potential bypass of range restrictions, which could lead to access to resources th...

Fedora 43 : perl-HarfBuzz-Shaper (2026-2b5249b4b6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2b5249b4b6 advisory. Merge branch 'rawhide' into f43 ---- Upgrade to upstream 0.032 to fix CVE-2026-22693. Tenable has extracted the preceding description block directly...

Oracle Linux 9 : php:8.2 (ELSA-2026-1409)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1409 advisory. php 8.2.30-1 - rebase to 8.2.30 php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip Tenable has extracted the preceding description block directly...

SUSE SLES15: libopenssl-3-devel / libopenssl-3-devel-32bit / etc (SUSE-SU-2026:0312-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0312-1 advisory. - CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing bsc1256830. - CVE-2025-68160: Heap...

Oracle Linux 9 : php:8.3 (ELSA-2026-1429)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1429 advisory. php 8.3.29-1 - rebase to 8.3.29 php-pecl-apcu php-pecl-redis6 php-pecl-rrd php-pecl-xdebug3 php-pecl-zip Tenable has extracted the preceding descriptio...

Oracle Linux 9 : python3.9 (ELSA-2026-1478)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-1478 advisory. 3.9.25-3.0.1 - Remove upstream URL reference 3.9.25-3 - Security fix for CVE-2025-12084 Resolves: RHEL-135897 Tenable has extracted the preceding description...

RHEL 9 : python3.12 (RHSA-2026:1583)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1583 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Fedora: Security Advisory (FEDORA-2026-f59e87ad88)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-1549 jishenghua jshERP PluginController uploadPluginConfigFile path traversal

A vulnerability was identified in jishenghua jshERP up to 3.6. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/plugin/uploadPluginConfigFile of the component PluginController. Such manipulation of the argument configFile leads to path traversal. The attack may ...

CVE-2025-14840 HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1...

CVE-2025-14840

The Drupal HTTP Client Manager module is vulnerable to Forceful Browsing due to an improper check for unusual or exceptional conditions. This issue stems from an insufficient separation of data from request operations, which could lead to information disclosure in very uncommon situations. The vu...

CVE-2025-14472 Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125

Cross-Site Request Forgery CSRF vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3...

CVE-2025-14472

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Acquia Content Hub module (SA-CONTRIB-2025-125). The root cause is that the module does not sufficiently protect export routes against CSRF attacks. This flaw could allow a malicious actor to trick an authenticated administrat...

CVE-2025-33237

creationtimestamp| type| source ---|---|--- 2026-01-28 20:01:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdj2u5cl322r...

EUVD-2025-206450

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2,...

CVE-2020-36962

Tendenci 12.3.1 is affected by a CSV formula injection in the contact form message field. A crafted payload like '=10+20+cmd|' /C calc'!A0' can trigger arbitrary command execution when the exported CSV is opened in spreadsheet applications. The vulnerability is caused by untrusted user input bein...

CVE-2025-13918

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are...

EUVD-2025-206455

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are...

SUSE-SU-2026:0314-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2025-12084: prevent quadratic behavior in node ID cache clearing bsc1254997. - CVE-2025-13836: prevent reading an HTTP response from a server, if no read amount is specified, with using Content-Length per default as the length bsc1254400...