PT-2026-89572

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

PT-2026-89685

Alt Text Endpoint Authorization Bypass via Payload Local API overrideAccess Omission Summary @jhb.software/payload-alt-text-plugin v0.7.0 exposes custom Payload CMS endpoints POST /api/alt-text-plugin/generate and /bulk that call the Payload Local API findByID and update without setting...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2025-002801)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002801 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a...

Oracle Linux 9 : ELSA-2026-66179-0: / perl-DBI (ELSA-2026-661790)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-661790 advisory. 1.643-9.5 - Use Module::Load for safer package loading in DBI::Profile CVE-2026-19546 Related: RHEL-236831 Tenable has extracted the preceding description blo...

RockyLinux 10 : kernel (RLSA-2026:65334)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65334 advisory. kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation CVE-2026-43133 kernel: Bluetooth: SMP: force responder MITM requirements before buildin...

AlmaLinux 10 : qt6-qt5compat (ALSA-2026:65816)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65816 advisory. qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 Tenable has extracted the preceding description block directly from the...

Oracle Linux 10 : ELSA-2026-66392-0: / apr-util (ELSA-2026-663920)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663920 advisory. - Resolves: RHEL-236629 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 ...

RHEL 8 : kernel (RHSA-2026:66325)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66325 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Servi...

Linux Distros Unpatched Vulnerability : CVE-2026-61911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed...

Fedora 43 : freeipa / samba (2026-bf202f7b3b)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-bf202f7b3b advisory. Update to Samba 4.23.12 along with freeipa rebuild Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Fedora 44 : GitPython (2026-1cb04a54d8)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1cb04a54d8 advisory. Update to 3.1.62 close RHBZ2529282 - Fixes GHSA-hmq2-w58f-27jc Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 46 : ruby (2026-fbf03424ec)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbf03424ec advisory. Update resolv gem in ruby.src to resolve security issues. Tenable has extracted the preceding description block directly from the Fedora security...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created HTML page...

Palo Alto Networks PAN-OS 9.0.x < 9.0.7 / 9.1.x < 9.1.2 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 9.0.x prior to 9.0.7 or 9.1.x prior to 9.1.2. It is, therefore, affected by a vulnerability. A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card LFC allows remote...

Palo Alto Networks PAN-OS 10.1.x / 10.2.x / 11.0.x / 11.1.x / 9.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 9.1.x, 10.1.x, 10.2.x, 11.0.x, or 11.1.x. It is, therefore, affected by a vulnerability. This vulnerability allows an attacker performing a meddler-in-the-middle attack between Palo Alto Networks PAN-OS...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : rabbitmq-c vulnerabilities (USN-8724-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8724-1 advisory. It was discovered that the rabbitmq-c...

AlmaLinux 9 : python-lxml (ALSA-2026:66204)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:66204 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

AlmaLinux 10 : opentelemetry-collector (ALSA-2026:65116)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:65116 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Oracle Linux 8 : ELSA-2026-64823-0: / redis:6 (ELSA-2026-648230)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648230 advisory. 6.2.24-1.0.1 - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 6.2.24-1 - rebase to 6.2.24 for CVE-2026-66373 Tenable has...

Unity Linux 20.1070a Security Update: gzip (UTSA-2026-107043)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107043 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...