CVE-2026-84077: Cross-Site Request Forgery (CSRF)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability...

CVE-2026-93685: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-63405: Insufficient Verification of Data Authenticity

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

PT-2026-95265

Name of the Vulnerable Software and Affected Versions product affected versions not specified Description An improper authentication issue allows remote attackers to compromise system security. Recommendations At the moment, there is no information about a newer version that contains a fix for th...

CVE-2026-40538: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-84106: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

Fedora 43 : stb (2026-0cae436fa5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0cae436fa5 advisory. Patch stbsprintf: security fix for CVE-2026-79516 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

CVE-2026-91147: Reachable Assertion

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

ROS-20260918-73-0036

The vulnerability of the smb2getea function in the fs/smb/server/smb2pdu.c file of the Smb kernel of the Linux operating system is related to memory writing beyond the bounds of the allocated buffer. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality,...

Linux Distros Unpatched Vulnerability : CVE-2026-92473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gfsgcommanddel of the file src/scenegraph/commands.c of the component BIF...

The vulnerability of the LcpDecodeConfig() function in the operating system kernel of FreeBSD allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the LcpDecodeConfig function in the kernel of the FreeBSD operating system is related to improper handling of discrepancies in parameter length. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

Fedora 44 : freeciv (2026-3b9c14cd66)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b9c14cd66 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

EulerOS Virtualization 2.11.0 : python-virtualenv (EulerOS-SA-2026-3556)

According to the versions of the python-virtualenv packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...

Fedora 43 : freeciv (2026-75bde5d061)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-75bde5d061 advisory. 3.2.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

CVE-2026-11540: Incorrect Authorization

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet...

CVE-2026-93506: Server-Side Request Forgery (SSRF)

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-93310: Allocation of Resources Without Limits or Throttling

A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was inform...

CVE-2026-93314: Integer Overflow or Wraparound

A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTrueType.cc. Executing a manipulation of the argument segCnt can lead to integer overflow. The attack can be launched remotely. The exploit has been publicly...

CVE-2026-93309: Allocation of Resources Without Limits or Throttling

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-87774: Improper Neutralization of Special Elements used in an SQL Command

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...