Linux Distros Unpatched Vulnerability : CVE-2026-83609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in...

Linux Distros Unpatched Vulnerability : CVE-2026-83616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

RHEL 7 : freerdp (RHSA-2026:62401)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62401 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

RHEL 10 : php (RHSA-2026:62614)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62614 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection v...

Linux Distros Unpatched Vulnerability : CVE-2026-84837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to...

RockyLinux 8 : php:7.4 (RLSA-2026:62334)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62334 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...

ServiceNow Platform Unauthenticated Blind SQL Injection (CVE-2024-8924)

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Xanadu, Washington DC, and earlier Now Platform releases. This vulnerability could potentially enable an unauthenticated user to acquire unauthorized data stored within the Now Platform. Note that Nessus has n...

Linux Distros Unpatched Vulnerability : CVE-2026-83607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and ...

PT-2026-84845

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0 Description The FileField.render headers function in src/httpx2/httpx2/ multipart.py fails to validate header names or values when interpolating content type values and custom headers from the files tuple. This...

PT-2026-84802

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

PT-2026-84573

Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the server host outside containers...

EUVD-2025-210821

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

PT-2026-84864

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.6 fast-uri versions 3.0.0 through 3.1.6 fast-uri versions 4.0.0 through 4.1.3 Description The software serializes the port component of a URI without proper validation. During the recomposition of the authority,...

Linux Distros Unpatched Vulnerability : CVE-2026-83618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true...

MiracleLinux 9 : ansible-core-2.14.18-3.el9_8.1.ML.1 (AXSA:2026-1731:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1731:02 advisory. ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-83617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true...

RockyLinux 9 : php:8.2 (RLSA-2026:61903)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61903 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...

Oracle Linux 9 : ELSA-2026-61581-0: / tar (ELSA-2026-615810)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-615810 advisory. - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary...

PT-2026-84760

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

CVE-2026-84208

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the UserLocation plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing...