PT-2026-81496

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description The exrmultiview utility can perform a heap out-of-bounds write when combining two valid scanline EXR files if the union...

PT-2026-81886

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.25 through 9.0.120 Apache Tomcat versions 8.5.46 through 8.5.100 Apache Tomcat versions 7.0.97 through 7.0.109...

ALSA-2026:59347 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

PT-2026-81203

Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with require interaction? set to true, AshAuthentication serve...

PT-2026-81329

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is path within directory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read file and other code tools to access files...

PT-2026-81254

Name of the Vulnerable Software and Affected Versions Apache Hive versions prior to 4.2.1 Description An issue exists in the Hive Metastore where direct SQL partition-name resolution allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition...

PT-2026-81464

Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-81465

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-81853

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation...

ALSA-2026:59487 Important: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow...

ALSA-2026:59243 Important: python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Linux Distros Unpatched Vulnerability : CVE-2026-54874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself...

Linux Distros Unpatched Vulnerability : CVE-2026-52490

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop....

Linux Distros Unpatched Vulnerability : CVE-2026-63075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC...

Linux Distros Unpatched Vulnerability : CVE-2026-63074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for...

Fedora 43 : java-25-openjdk / java-latest-openjdk (2026-760df8d7e8)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-760df8d7e8 advisory. August CPU. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue...

Fedora 43 : java-21-openjdk / java-21-openjdk-portable (2026-40b2544dda)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-40b2544dda advisory. First monthly cadence release candidate Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

PT-2026-81610

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use-after-free issue exists in the Safebrowsing component of Google Chrome on Mac. A remote attacker can leverage social engineering to execute arbitrary code outside the sandbox by...

PT-2026-81633

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 152.0.7977.65 Description A use after free issue exists where a remote attacker can execute arbitrary code outside the sandbox by sending crafted network traffic. Use after free is a memory corruption fla...

PT-2026-81589

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A use-after-free issue exists in Views, which allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox. This is achieved b...