RockyLinux 10 : firefox (RLSA-2026:58899)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:58899 advisory. firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component CVE-2026-74983 firefox: thunderbird: Site isolation issue in the Graphics...

AlmaLinux 9 : python-urwid (ALSA-2026:58952)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:58952 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description block...

RockyLinux 8 : firefox (RLSA-2026:58898)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:58898 advisory. firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component CVE-2026-74983 firefox: thunderbird: Site isolation issue in the Graphics:...

PT-2026-81614

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An observable discrepancy in the Scalable Vector Graphics SVG implementation allows a remote attacker to obtain cross-origin data by using a crafted HTML page. Recommendations Update...

PT-2026-81599

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 152.0.7977.65 Description An information leak exists in the Bluetooth component. A remote attacker who has compromised the renderer process and uses social engineering can obtain sensitive information by...

PT-2026-81809

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Code injection in Bisection allows a remote attacker to obtain sensitive information through the use of a crafted file. Recommendations Update Google Chrome to version 152.0.7977.65 or...

PT-2026-81419

Name of the Vulnerable Software and Affected Versions OpenEXRUtil versions 3.3.0 through 3.3.12 OpenEXRUtil versions 3.4.0 through 3.4.12 Description The TypedDeepImageChannel::row API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin. This occurs because...

PT-2026-81638

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Missing authorization in WebAppInstalls allows a remote attacker who has compromised the renderer process to obtain sensitive information by using a crafted HTML page...

PT-2026-81279

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

PT-2026-81509

Name of the Vulnerable Software and Affected Versions NVIDIA OpenShell affected versions not specified Description A flaw exists where a malicious gateway can trigger OS command injection. This could allow an attacker to execute arbitrary code, tamper with data, and disclose sensitive information...

PT-2026-81682

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak in the Payments component allows a remote attacker to obtain cross-origin data by using a crafted HTML page. Cross-origin data refers to information belonging to a...

PT-2026-81687

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Missing authorization in Sensor allows a remote attacker who has compromised the renderer process to obtain sensitive information through a crafted HTML page. Recommendations Update...

PT-2026-81616

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak exists in FoldableAPIs that allows a remote attacker to obtain sensitive information by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-81632

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incorrect authorization in WebProtect allows a remote attacker to obtain sensitive information by using a crafted HTML page. Recommendations Update Google Chrome to version 152.0.7977.6...

PT-2026-81538

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An information leak in Canvas allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can...

PT-2026-81825

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Incomplete cleanup in the GetUserMedia function allows a remote attacker to obtain sensitive information. This requires the attacker to have already compromised the renderer process and...

PT-2026-81667

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in the Sync component allows a remote attacker to obtain sensitive information by sending crafted network traffic. Recommendations Update Google Chrome to...

FreeBSD-SA-26:56.hwpmc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:56.hwpmc Security Advisory The FreeBSD Project Topic: hwpmc fails to detach PMCs during exec credential transitions Category: core Module: hwpmc Announced:...

RockyLinux 9 : python-urwid (RLSA-2026:58952)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58952 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description bloc...

Linux Distros Unpatched Vulnerability : CVE-2026-78678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers t...