CVE-2024-11137

An Insecure Direct Object Reference IDOR vulnerability exists in the PATCH /v1/runs/:id/score endpoint of lunary-ai/lunary version 1.6.0. This vulnerability allows an attacker to update the score data of any run by manipulating the id parameter in the request URL, which corresponds to the...

CVE-2024-10445

Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS BSM before 1.1-65374 and Synology DiskStation Manager DSM before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to write limited files via...

AlmaLinux 8 : libreoffice (ALSA-2025:2868)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:2868 advisory. libreoffice: Macro URL arbitrary script execution CVE-2025-1080 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory...

CVE-2024-11285 WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover

The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 7.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the accountsettingscallback function. This...

python311-3.11.11-4.1 on GA media (moderate)

python311-3.11.11-4.1 on GA media Announcement ID: openSUSE-SU-2025:14872-1 Rating: moderate Cross-References: CVE-2025-1795 CVSS scores: CVE-2025-1795 SUSE : 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2025-1795 SUSE : 2.3...

PT-2025-11033 · Bitdefender · Bitdefender Box

Name of the Vulnerable Software and Affected Versions: Bitdefender Box versions 1.3.11.490 through 1.3.11.505 Description: The issue concerns the use of the insecure HTTP protocol to download assets over the Internet for updating and restarting daemons and detection rules on devices. Updates can ...

CVE-2025-21199

creationtimestamp| type| source ---|---|--- 2025-03-11 16:39:36+00:00| seen| https://www.thezdi.com/blog/2025/3/11/the-march-2025-security-update-review 2025-08-13 13:26:34+00:00| seen| MISP/682bdba3-46b7-4a8f-b7be-c6bf4b4f9868...

CVE-2025-26646

creationtimestamp| type| source ---|---|--- 2025-03-11 16:39:36+00:00| seen| https://www.thezdi.com/blog/2025/3/11/the-march-2025-security-update-review 2025-05-13 16:27:02+00:00| seen| https://www.thezdi.com/blog/2025/5/13/the-may-2025-security-update-review 2025-05-13 22:59:37+00:00| seen|...

CVE-2025-22366 Mennekes smart/premium charges systems, Command injection in firmware upgrade

The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command are improperly neutralized when certain fields are passed to the underlying OS...

macOS 15.x < 15.3.2 (122283)

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.3.2. It is, therefore, affected by a vulnerability: - Out of bounds write in GPU on Mac. CVE-2025-24201 Note that Nessus has not tested for this issue but has instead relied only on the operating system's...

CVE-2024-57902 affecting package kernel for versions less than 5.15.176.3-3

CVE-2024-57902 affecting package kernel for versions less than 5.15.176.3-3. An upgraded version of the package is available that resolves this issue...

Medium: ecs-init

Issue Overview: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init...

Fedora 41 : xen (2025-20f63c4273)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-20f63c4273 advisory. deadlock potential with VT-d and legacy PCI device pass-through XSA-467, CVE-2025-1713 Tenable has extracted the preceding description block directly from th...

Fedora 41 : wireshark (2025-08e73d463e)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-08e73d463e advisory. New version 4.4.4 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 40 : python3.6 (2025-e60e30944c)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e60e30944c advisory. Security fix CVE-2025-0938 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

WordPress wpForo Forum plugin <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update vulnerability

Authenticated Subscriber+ Arbitrary File Read in update vulnerability discovered by mikemyers in WordPress Plugin wpForo Forum versions = 2.4.1...

WordPress RateMyAgent Official plugin <= 1.4.0 - Cross-Site Request Forgery to API Key Update vulnerability

Cross-Site Request Forgery to API Key Update vulnerability discovered by Dhabaleshwar Das in WordPress Plugin RateMyAgent Official versions = 1.4.0...

Debian: Security Advisory (DLA-4065-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

proftpd-1.3.8c-2.1 on GA media (moderate)

proftpd-1.3.8c-2.1 on GA media Announcement ID: openSUSE-SU-2025:14827-1 Rating: moderate Cross-References: CVE-2024-57392 CVSS scores: CVE-2024-57392 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

AlmaLinux 9 : postgresql (ALSA-2025:1742)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:1742 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...