VulnCheck KEV: CVE-2020-9771

This issue was addressed with a new entitlement. This issue is fixed in macOS Catalina 10.15.4. A user may gain access to protected parts of the file system...

UBUNTU-CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

UBUNTU-CVE-2026-14180

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

UBUNTU-CVE-2026-48813

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contai...

RHEL 8 : freerdp (RHSA-2026:54485)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54485 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Slackware Linux 15.0 / current rsync Vulnerability (SSA:2026-225-01)

The version of rsync installed on the remote host is prior to 3.5.0. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-225-01 advisory. New rsync packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding descriptio...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.9 (7283488)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7283488 advisory. - IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

RHEL 9 : yelp (RHSA-2026:54539)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54539 advisory. Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, includin...

RockyLinux 10 : dhcpcd (RLSA-2026:54210)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54210 advisory. dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length IPv6 ND option in Router Advertisement handling CVE-2026-14258 Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2026-48804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-socketio is a Python implementation of the Socket.IO realtime client and server. The python- socketio server stores binary EVENT and ACK messages in memo...

Fedora 44 : cri-o1.34 (2026-8ce4ffda9c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8ce4ffda9c advisory. - Update to release v1.34.11 - Resolves: rhbz2510870 - Resolves CVE-2026-34986: rhbz2455652 - Upstream fixes Tenable has extracted the preceding description...

FreeBSD : phpmyfaq -- multiple vulnerabilities (7a691536-968b-11f1-9863-50ebf6bdf8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7a691536-968b-11f1-9863-50ebf6bdf8e9 advisory. phpMyFAQ team reports: The WebAuthn login flow never persists the challenge it issues, so the replay...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.2)

The version of AHV installed on the remote host is prior to 11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.2 advisory. - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elfswapshdr in the library bfd/elfcode....

openSUSE 16 Security Update : go-sendxmpp (openSUSE-SU-2026:21562-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21562-1 advisory. Changes in go-sendxmpp: - Update to 0.17.0: Add --ox-transfer-private-key to transfer the encrypted private key to PEP to transfer it to other devices...

PT-2026-76574

Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body Description Etherpad ships an endpoint pair under /tokenTransfer src/node/hooks/express/tokenTransfer.ts that lets a logged-in user move their...

Linux Distros Unpatched Vulnerability : CVE-2026-73499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a...

MiracleLinux 9 : python3.14-3.14.5-1.el9_8.1 (AXSA:2026-1523:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1523:05 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding...

RHEL 8 : yelp (RHSA-2026:54666)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:54666 advisory. Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, includin...

Oracle Linux 8 : python-idna (ELSA-2026-54290)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-54290 advisory. 2.5-8 - Security fix for CVE-2026-45409 Resolves: RHEL-215650 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files...