CVE-2026-95180

An issue in Justson agentweb-core versions v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components . This is caused by incorrect access control during the handling of intent:// URLs within the DefaultWebClient compone...

CVE-2026-55453: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quotestring function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before reportattr writes the value to the...

CVE-2026-61702: Improper Limitation of a Pathname to a Restricted Directory

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets...

CVE-2026-101025

Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...

CVE-2026-67418

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated...

CVE-2026-55239: Improper Neutralization of Special Elements used in an SQL Command

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

Unity Linux 20.1070e Security Update: gdk-pixbuf2 (UTSA-2026-130381)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130381 advisory. A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave sta...

Unity Linux 20.1070e Security Update: perl-YAML (UTSA-2026-130395)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130395 advisory. Unity Link Advisory UTSA-2026-130395 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2026-130349)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130349 advisory. An integer overflow in the libavfilter/vfscale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted...

Unity Linux 20.1070e Security Update: busybox (UTSA-2026-130374)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130374 advisory. A heap overflow in the ifsbreakup function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted input. Tenable ha...

MiracleLinux 9 : python-tornado-6.5.10-1.el9_8.1 (AXSA:2026-2053:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2053:04 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block...

Unity Linux 20.1070a Security Update: gawk (UTSA-2026-126727)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126727 advisory. Integer overflow vulnerability has been found in builtin.c program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could b...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2026-130393)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130393 advisory. An integer overflow in the yuv2planeX8c function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a...

GitLab 19.2 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-85529)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...

Rocky Linux 9.6 [TuxCare] Security Update: mutt (ALMALINUX9.6:CLSA-2026:1792092200)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792092200 advisory. - heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...

CVE-2026-95116

An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtagfile in src/blocks/fromswf.c...

CVE-2026-103502

Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...

CVE-2026-95179

An issue in lottie-android 6.7.1 and earlier and master allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer...

CVE-2026-95180

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...

PT-2026-114791

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...