CVE-2026-17503: Improper Input Validation

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter...

CVE-2026-18857: Out-of-bounds Read

IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to...

Fedora 45 : bcm283x-firmware / uboot-tools (2026-313e66c007)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-313e66c007 advisory. Update to the latest U-Boot 2026.10 RC4 fixes Display fixes from sleep for some generations of Raspberry Pi Tenable has extracted the preceding description...

CVE-2026-96807

A flaw was found in Flatpak. A malicious sandboxed application can manipulate a symlink, causing the regenerateldcache function to write files to an unintended location. While the attacker cannot control the content or filenames, this vulnerability could lead to a low impact on system integrity o...

Security Bulletin: This Power System update is being released to address CVE-2026-17503

Summary Power Systems Firmware is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention —...

python313-graphifyy-0.9.65-1.1 on GA media (moderate)

python313-graphifyy-0.9.65-1.1 on GA media Announcement ID: openSUSE-SU-2026:11839-1 Rating: moderate Cross-References: CVE-2026-54058 CVSS scores: CVE-2026-54058 SUSE : 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2026-54058 SUSE : 5.9...

Oracle Linux 9 : runc (ELSA-2026-70191)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-70191 advisory. - rebuild for CVE-2026-56860 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

Fedora 43 : cyrus-imapd (2026-97a7ec5786)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97a7ec5786 advisory. - New version 3.10.4 rhbz2500822 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

CVE-2026-95805 MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'themingenabled' with a trailing asterisk instead of the correct 'themingenabled'. In the MISP ACL system, the array values define which role o...

kyverno-1.19.1-1.1 on GA media (moderate)

kyverno-1.19.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11822-1 Rating: moderate Cross-References: CVE-2026-39821 CVE-2026-56853 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1...

PT-2026-96785

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A typo in the ACLComponent access control configuration causes the ACL rule for the previewEventAttributes action to reference the permission string theming enabled instead of theming enabled...

Slackware Linux 15.0 / current util-linux Vulnerability (SSA:2026-264-01)

The version of util-linux installed on the remote host is prior to 2.42.4. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-264-01 advisory. New util-linux packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the precedin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000533)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000533 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. Tenable has extracted the preceding description block directly from the Unity Linux security...

CVE-2026-93952: Improper Input Validation

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

SUSE CVE-2026-93586

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

Oracle Linux 10 : yggdrasil-worker-package-manager (ELSA-2026-69099)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-69099 advisory. 0.2.3-8 - Rebuild against updated golang Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

alloy-1.19.2-1.1 on GA media (moderate)

alloy-1.19.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11803-1 Rating: moderate Cross-References: CVE-2026-2303 CVE-2026-37236 CVE-2026-41178 CVE-2026-45679 CVE-2026-45680 CVE-2026-45681 CVE-2026-45683 CVE-2026-45684 CVE-2026-46600 CVE-2026-48496 CVE-2026-56852 CVE-2026-56854 CVE-2026-715...

CVE-2026-93587

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...

PT-2026-95682

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A missing authentication flaw exists in the LoadBalancerServlet endpoint. This allows an unauthenticated user to perform privileged load-balancer operations, which could lead to unauthorize...

alsa-1.2.16.1-2.1 on GA media (moderate)

alsa-1.2.16.1-2.1 on GA media Announcement ID: openSUSE-SU-2026:11783-1 Rating: moderate Cross-References: CVE-2026-90781 CVSS scores: CVE-2026-90781 SUSE : 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2026-90781 SUSE : 4.8...