openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:21594-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21594-1 advisory. Update to Firefox Extended Support Release 140.14.0 ESR. - MFSA 2026-76 bsc1274867 CVE-2026-74934: Site isolation issue in the Graphics:...

Kibana 9.4.x < 9.4.4 Privilege Escalation (ESA-2026-83)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-83 advisory. - Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature...

VulnCheck KEV: CVE-2026-61979

Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...

PT-2026-79396

Name of the Vulnerable Software and Affected Versions Azure SQL Database affected versions not specified Description Server-side request forgery SSRF allows an unauthorized attacker to elevate privileges over a network. SSRF is a flaw where an attacker can induce the server-side application to ma...

Kibana 9.1.x < 9.4.5 / 9.5.x < 9.5.1 Privilege Escalation (ESA-2026-128)

The version of Kibana installed on the remote host is 9.1.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-128 advisory. - Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege...

PT-2026-82767

Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 Description The Monitor subscription handler fails to properly authorize access to the configuration-key store. A CephX user with mon allow r capabilities can read the entire store by...

PT-2026-79294

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

CVE-2026-64728

A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy...

Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 Cross-Site Request Forgery (ESA-2026-99)

The version of Kibana installed on the remote host is 8.19.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-99 advisory. - Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request...

Debian dla-4750 : firefox-esr - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4750 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4750-1 [email protected]...

Kibana 8.x < 8.19.20 / 9.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-87 / ESA-2026-88)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, or 9.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-87 and ESA-2026-88 advisories. - A lower privileged user who holds only the privilege to read agent policies can...

The vulnerability of the Metabase data visualization and reporting software lies in the lack of security measures for query structures, allowing attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...

PT-2026-82765

Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 Description The RADOS Gateway RGW uses an AES-128-CBC handler to protect STS session tokens that lacks message authentication. This allows an attacker with a valid STS token to perfor...

openSUSE 16: kubevirt1.8-container-disk / kubevirt1.8-libguestfs-tools / etc (openSUSE-SU-2026:21590-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21590-1 advisory. Update to version 1.8.4. Security issues fixed: - CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via...

Fedora 43 : wordpress (2026-61704c09ea)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-61704c09ea advisory. WordPress 6.9.7 Release Security update included in this release - Authenticated Author+ remote code execution via malicious file upload on sites th...

The vulnerability of the Apache HTTP Server web server, related to insecure management of privileges, allows attackers to elevate their own privileges.

The vulnerability of the Apache HTTP Server web server is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to increase their privileges...

Kibana 8.19.x < 8.19.20 / 9.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-126 / ESA-2026-127 / ESA-2026-129)

The version of Kibana installed on the remote host is 8.19.x prior to 8.19.20, 9.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-126, ESA-2026-127 and ESA-2026-129 advisories. - Incorrect Authorization CWE-863 in Kiba...

RockyLinux 9 : mrtg (RLSA-2026:57600)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57600 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

Unity Linux 20.1070a Security Update: attr (UTSA-2026-102708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102708 advisory. attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by...

PT-2026-79283

Name of the Vulnerable Software and Affected Versions VOCALOID6 affected versions not specified Description A missing authentication for critical function issue exists in VOCALOID6. This allows any process running under the same local user account as an active VOCALOID6 Editor instance to escalat...