CVE-2026-63405: Insufficient Verification of Data Authenticity

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

CVE-2026-93534: Download of Code Without Integrity Check

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...

CVE-2026-93576: Improper Neutralization of CRLF Sequences

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-84073: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2024-56344: Use of a Broken or Risky Cryptographic Algorithm

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...

The vulnerability of the LcpDecodeConfig() function in the operating system kernel of FreeBSD allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the LcpDecodeConfig function in the kernel of the FreeBSD operating system is related to improper handling of discrepancies in parameter length. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-92473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gfsgcommanddel of the file src/scenegraph/commands.c of the component BIF...

Fedora 44 : freeciv (2026-3b9c14cd66)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b9c14cd66 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

Fedora 43 : freeciv (2026-75bde5d061)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-75bde5d061 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

CVE-2026-93505: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

CVE-2026-55556: Heap-based Buffer Overflow

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

EulerOS Virtualization 2.11.0 : python-virtualenv (EulerOS-SA-2026-3556)

According to the versions of the python-virtualenv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...

CVE-2026-93309: Allocation of Resources Without Limits or Throttling

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-10747: Heap-based Buffer Overflow

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication...

CVE-2026-84036: Improper Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-84076: Improper Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization...

CVE-2026-80441: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting...

CVE-2026-93533: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-93650: Improper Restriction of Excessive Authentication Attempts

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function getclientip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed...

CVE-2026-92747: Invocation of Process Using Visible Sensitive Information

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as rootPassword and userPassword. This occurs when the installmachine.py script passes these credentials as...