Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities

The version of Metabase installed on the remote host is 0.58.x prior to 0.58.24, 0.59.x prior to 0.59.21, 0.60.x prior to 0.60.17, 0.61.x prior to 0.61.11, 0.62.x prior to 0.62.9, 0.63.x prior to 0.63.5, 1.58.x prior to 1.58.24, 1.59.x prior to 1.59.21, 1.60.x prior to 1.60.17, 1.61.x prior to...

Linux Distros Unpatched Vulnerability : CVE-2026-68316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3548-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3548-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when t...

PT-2026-71173

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

MiracleLinux 9 : maven:3.9 (AXSA:2026-1516:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1516:01 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description bloc...

Linux Distros Unpatched Vulnerability : CVE-2026-13505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and...

ROS-20260812-73-0025

The vulnerability of the Wireshark parser for analyzing BLF files related to traffic analysis in computer networks is linked to errors during initialization. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protected by security measures...

ROS-20260812-73-0022

The vulnerability in Wireshark is related to overflowing of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260812-73-0028

The vulnerability in Wireshark is related to the swapping of the zero pointer. Exploiting this vulnerability can allow a hacker to cause a service failure...

Debian dla-4732 : libapache2-mod-php8.2 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4732 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4732-1 [email protected]...

PT-2026-71339

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13 Description Authenticated attackers can read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download export method. By using ../ sequences, an attack...

PT-2026-71140

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description An authenticated API user with XCom write-and-read access can instantiate arbitrary airflow. classes on the API server. This occurs because the GET /api/v2/.../xcomEntries/key?deserialize=true...

PT-2026-71260

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test email settings action, which are evaluated when an SMTP rejection reflects the recipient addres...

PT-2026-76569

Stata Command Injection via Unsanitized package in ado package install Summary The ado package install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent...

PT-2026-71192

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions due to improper neutralization of special elements in an SQL parameter. This issue occurs when the system fails to correctly sanitize...

Linux Distros Unpatched Vulnerability : CVE-2026-19548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple Use-After-Free vulnerabilities were found in the addarchiveelement function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root caus...

RHEL 8 : abrt (RHSA-2026:54272)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54272 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...

PT-2026-71304

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3560-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3560-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-73088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats in node.js, reach...