PT-2026-81826

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue in DevTools allows a remote attacker to execute arbitrary code inside the sandbox. This is achieved by leveraging social engineering and a crafted Chrome extensio...

PT-2026-81595

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use-after-free issue exists in the Compositing component. This occurs when memory is accessed after it has been freed, which can be triggered by a remote attacker using a specially...

PT-2026-81834

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use after free issue in ANGLE allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free is a memory...

PT-2026-81860

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

RHEL 8 : nginx:1.24 (RHSA-2026:59216)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59216 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage...

AlmaLinux 9 : python3.12 (ALSA-2026:59009)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59009 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descriptio...

Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a log injection vulnerability: - The Basic authentication username is decoded before credential validation and passed to the access logger without neutralizing control characters. A...

RHEL 9 : osbuild-composer (RHSA-2026:59562)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59562 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

PT-2026-81347

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handle connection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing start session commands and...

EulerOS Virtualization 2.13.0 : python-urllib3 (EulerOS-SA-2026-3234)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...

CVE-2026-52491

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main component...

UBUNTU-CVE-2026-59183

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32t multiplication in OpenEXRCore's unpacksampletable can overflow while decoding...

JetBrains TeamCity < 2020.1.2 (CVE-2020-27627)

The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.2. It is, therefore, affected by a vulnerability: - JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. CVE-2020-27627 Note that Nessus has not tested for this issue but has instead relied only on th...

UBUNTU-CVE-2026-55373

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp rounds a sample-list size up to the...

UBUNTU-CVE-2026-55059

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12 and 3.4.13 contain a heap out-of-bounds write in Imf40::SampleCountChannel::setint r, unsigned int newNumSamples. The row-based...

UBUNTU-CVE-2026-54920

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abo...

UBUNTU-CVE-2026-68516

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

ALSA-2026:59490 Important: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2026-3176)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : USB: core: Limit the length of unkillable synchronous timeoutsCVE-2026-43428 usb: typec: ucsi: validate connector number in...

ALSA-2026:59242 Important: python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...