Nessus Network Monitor < 6.6.0 Multiple Vulnerabilities (TNS-2026-32)

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-32 advisory. - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree ...

CVE-2026-119620: 37954679 cak-filemanagement-system: A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297

A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function moveuploadedfile of the file admin/addlogs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack ma...

CentOS Linux 6 [TuxCare] Security Update: patch (CENTOS6:CLSA-2026:1793083677)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793083677 advisory. - A double free exists in the anotherhunk function in pch.c in GNU patch through 2.7.6. CVE-2018-6952 Note that Nessus has not tested for this...

RHEL 9 : webkit2gtk3 (RHSA-2026:92216)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92216 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

CentOS Linux 7 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc (CENTOS7:CLSA-2026:1793106820)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793106820 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory...

PT-2026-133466

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.7.8 Description Authenticated users with System: Firmware privileges can execute commands as root by providing a malicious firmware mirror URL. This occurs when shell metacharacters are submitted via the 'POST...

RHEL 8 : webkit2gtk3 (RHSA-2026:92339)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92339 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

RHEL 9 : kernel (RHSA-2026:92993)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92993 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ata: ahci: Match EMMAXSLOTS...

PT-2026-134459

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.79 Description Unauthorized account access is possible due to the use of predictable passwords for built-in dummy us...

PT-2026-134196

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.4 Description The ReadAdaptedClass function in src/classify/adaptive.cpp reads an ADAPT CLASS STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any...

PT-2026-134463

Name of the Vulnerable Software and Affected Versions Popup Builder versions prior to 4.4.6 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to move all published popup...

Juspay Technologies Composable Open-Source Payments Infrastructure input validation error vulnerability

Versions prior to 1.128.0 and 2026.10.01.0 of Juspay Technologies’ Composable Open-Source Payments Infrastructure contain an input validation error vulnerability. This vulnerability arises because the verifywebhooksource function within the Worldpayxml connector always returns true without...

PT-2026-133281

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contentegg metabox' and the generic 'edit posts'...

PT-2026-133610

Name of the Vulnerable Software and Affected Versions SOCFortress CoPilot versions prior to 0.1.77 Description The application allows admin and analyst users to upload content via the 'POST /api/scoutsuite/generate-gcp-report' endpoint. The system validates the content as GCPScoutSuiteJSON but...

PT-2026-134194

Name of the Vulnerable Software and Affected Versions Metalama versions 2023.0.101-rc through 2025.1.17 Metalama versions 2026.0.x through 2026.0.24 Metalama versions 2026.1.0 through 2026.1.18 Metalama + PostSharp extension versions 2024.1 through 2026.1.4 Metalama extension affected versions no...

CVE-2026-115456

A flaw was found in gcc. An attacker could cause a Denial of Service DoS by passing a string that is not null-terminated to the std::fromchars function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or a...

MONAI Project code injection vulnerability

Project MONAI: Versions prior to MONAI 1.6.0 and 1.6.1 contain a code injection vulnerability. This vulnerability stems from improper handling by the auto3dseg algofromjson function of algoobject.json located in a specially crafted working directory, as well as malicious algorithmtemplates module...

PT-2026-134216

In Trail of Bits fickling through 0.1.12, a pickle STACK GLOBAL operand carrying a dotted qualname for example "Values.read file" is resolved by pickle's find class through getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading...

PT-2026-134250

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, deepExtend in src/utils.js checks property existence with the in operator and recurses into inherited built-ins reached through Object.prototype. An application must explicitly pass attacker-controlled resource...

Elixir programming language Elixir input validation error vulnerability

A security vulnerability exists in the Elixir programming language versions prior to 0.5.0 through 1.18.6, from 1.19.0-rc.0 up to 1.19.7, and from 1.20.0-rc.0 up to 1.20.5. This vulnerability stems from improper validation of the number of ports specified in input by the URI module. In...