MiracleLinux 4 : httpd24-1.1-18.AXS4, httpd24-httpd-2.4.27-8.AXS4 (AXSA:2017-2405:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2405:01 advisory. A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htacce...

MiracleLinux 4 : httpd-2.2.15-60.6.0.1.AXS4 (AXSA:2017-2391:05)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2391:05 advisory. A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004176)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004176 advisory. A potential vulnerability in the AMD extension to Linux hwmon service may allow an attacker to use the Linux-based Running Average Power Limit RAPL interface to show...

MiracleLinux 7 : httpd-2.4.6-67.5.0.1.el7.AXS7 (AXSA:2017-2357:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2357:03 advisory. A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htacce...

CakePHP cross-site scripting vulnerabilities

CakePHP is an open-source web development framework based on the MVC architecture, created by the CAKE Foundation in the United States. This framework features flexible view caching, automatic generation of CRUD code, and other functionalities. Versions of CakePHP prior to 5.2.12 and 5.3.1...

MiracleLinux 4 : bind-9.8.2-0.68.3.rc1.AXS4 (AXSA:2019-3921:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-3921:01 advisory. bind: Limiting simultaneous TCP clients is ineffective CVE-2018-5743 Tenable has extracted the preceding description block directly from the MiracleLinux...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001550)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001550 advisory. A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004358)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004358 advisory. A potential vulnerability in the AMD extension to Linux hwmon service may allow an attacker to use the Linux-based Running Average Power Limit RAPL interface to show...

CVE-2026-0989

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may...

CVE-2026-22820

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5...

UBUNTU-CVE-2026-0989

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may...

EUVD-2026-2796

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may...

SUSE CVE-2025-68802

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Limit numsyncs to prevent oversized allocations The exec and vmbind ioctl allow userspace to specify an arbitrary numsyncs value. Without bounds checking, a very large numsyncs can force an excessively large allocation,...

Shibboleth SSO Open Redirect

Shibboleth Service Provider SP contains an open redirect vulnerability. An attacker can exploit this vulnerability to redirect users to malicious websites, potentially leading to phishing attacks or other malicious activities. This issue arises when the 'redirectLimit' configuration option is not...

CVE-2026-22820

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5...

CVE-2025-71111

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d Convert macros to functions to avoid TOCTOU The macro FANFROMREG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use TOCTO...

UBUNTU-CVE-2025-71111

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d Convert macros to functions to avoid TOCTOU The macro FANFROMREG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use TOCTO...

CVE-2025-71109

In the Linux kernel, the following vulnerability has been resolved: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Since commit e424054000878 "MIPS: Tracing: Reduce the overhead of dynamic Function Tracer", the macro UASMiLAmostly has been used, and this macro can...

CVE-2026-22820

CVE-2026-22820 affects the Outray open-source CLI (an ngrok-like tool). The vulnerability is a TOCTOU race condition in tunnel creation that can allow a user to bypass the plan’s active-tunnels limit, potentially creating more tunnels than allowed. The issue occurs during registration: the code c...

CVE-2025-71111 hwmon: (w83791d) Convert macros to functions to avoid TOCTOU

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d Convert macros to functions to avoid TOCTOU The macro FANFROMREG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use TOCTO...