JetBrains TeamCity < 2021.2.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. CVE-2022-24330 - In JetBrains TeamCity before 2021.2.1, the Agent...

Wazuh Server 4.3.0 < 4.14.6 Path Traversal (CVE-2026-49441)

The version of Wazuh Server on the remote host is at least 4.3.0 and prior to 4.14.6. It is, therefore, affected by a path traversal vulnerability: - The non-merged branch of processfilesfromworker trusts a peer-controlled filepath key from filesmetadata.json. A cluster peer holding the shared...

JetBrains TeamCity < 2022.04.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases CVE-2022-36321 - In JetBrains TeamCity before...

FreeBSD : mod_gnutls -- multiple vulnerabilities (a7b4cdfc-9f9d-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a7b4cdfc-9f9d-11f1-a655-3497f65b111b advisory. The modgnutls project reports: Security fix CVE-2026-33307: Fix out-of-bounds write when...

PT-2026-81239

Name of the Vulnerable Software and Affected Versions Mask extension affected versions not specified Description An authenticated backend user with access to the Mask module can perform path traversal, a technique used to access files and directories that are restricted from the user. The extensi...

OpenSSL -- Multiple vulnerabilities

The OpenSSL poject reports: Heap Buffer Overflow in CMS Key Unwrapping CVE-2026-63072 Moderate Invalid Pointer Dereference in CMP Server via Crafted protectionAlg CVE-2026-63076 Moderate RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate CVE-2026-14457 Low Excessive...

PT-2026-81122

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

JetBrains TeamCity < 2021.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used. CVE-2021-37546 - In JetBrains TeamCity before...

UBUNTU-CVE-2026-63072

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...

PT-2026-81379

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges...

CVE-2026-63072

Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a...

Wazuh Server 4.0.0 < 4.14.5 Incorrect Authorization (CVE-2026-44252)

The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.5. It is, therefore, affected by an incorrect authorization vulnerability: - A low-privilege read-only API user with manager:read permission can retrieve the cluster key from ossec.conf. An attacker can use the...

TencentOS Server 4: opensc (TSSA-2026:0853)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0853 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

JetBrains TeamCity < 2022.04.3 (CVE-2022-38133)

The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.3. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases CVE-2022-38133 Note that Nessus has not tested for thi...

java-1.7.0-openjdk: Fix of 11 CVEs

CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...

CLSA-2026-1787222376 java-1.7.0-openjdk: Fix of 11 CVEs

CVE-2024-20952: Enhance TLS connection support JDK-8317547, JDK-8302017 - CVE-2025-21587: Better TLS connection support JDK-8337692 - CVE-2026-34268: Enhance key generation JDK-8371935 - CVE-2026-22007: Enhance crypto algorithm support JDK-8369575 - CVE-2026-21925: Improve JMX connections...

CVE-2026-59648

A flaw was found in Bouncy Castle for Java. The OpenPGP Argon2 S2K Salted Key Derivation Function implementation allows a remote attacker to influence the amount of memory and passes used during key derivation. This can lead to a denial of service DoS by consuming excessive system resources, maki...

CVE-2026-59640

A flaw was found in Bouncy Castle for Java. A remote attacker can exploit an OpenPGP Open Pretty Good Privacy Cipher Feedback CFB quick-check oracle vulnerability. This oracle, active on symmetric and session-key paths, could allow an attacker to gain sensitive information by observing the result...

Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key

gorilla/websocket used math/rand cryptographically weak pseudo-random number generator to generate WebSocket frame mask keys prior to commit d67f4185. WebSocket masking keys MUST be unpredictable to prevent frame content injection attacks. math/rand produces deterministic output when seeded with ...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview github.com/gorilla/websocket is a Go implementation of the WebSocket protocol. Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG via the newMaskKey function in conn.go. An attacker can predict or recover WebSocket frame...