CentOS Linux 7.9 [CIQ] Security Update: python-setuptools (ciqsa-2026_0732)

The CentOS Linux 7.9 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20260732 advisory. This advisory aggregates security fixes for the python-setuptools SRPM in CIQ CentOS Bridge 7.9. It addresses 1 CVE: CVE-2024-6345. Tenable has extracted the...

Rocky Linux 8.6 [CIQ] Security Update: python39-ply (ciqsa-2026_0234)

The Rocky Linux 8.6 host has a package installed that is affected by a vulnerability as referenced in the CIQ ciqsa-20260234 advisory. This advisory aggregates security fixes for the python-ply SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2021-28861. Tenable has extracted the preceding descriptio...

Rocky Linux 8.8 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel / etc (ciqsa-2026_1034)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261034 advisory. This advisory aggregates security fixes for the expat SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2023-52425. Tenable has extracted the preceding description blo...

AlmaLinux 9.2 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc (ALMALINUX9.2:CLSA-2025:1763125295)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763125295 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

PT-2026-105189

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-97280: Missing Authorization

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...

PT-2026-103983

Name of the Vulnerable Software and Affected Versions Joyland AI affected versions not specified Description The application fails to validate TLS certificates from servers, allowing it to accept any certificate regardless of its authenticity. This lack of validation can enable man-in-the-middle...

PT-2026-103705

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

PT-2026-103852

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...

PT-2026-103853

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...

CVE-2026-103341: Missing Authorization

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...

PT-2026-103668

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId lead...

PT-2026-103674

Name of the Vulnerable Software and Affected Versions ZongXR SuperMarket version 1.0.0.0 Description A weakness in the Instant Buy component allows remote attackers to bypass authentication. This occurs through the manipulation of the Username argument within the startBuy function located in the...

PT-2026-103991

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 1.5 Description The UpdateCE update form lacks anti-CSRF tokens, and the POST handler does not verify tokens or request origins. This allows a remote attacker to host a page that auto-submits a forged POST reque...

PT-2026-103867

iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...

AlmaLinux 9.2 [TuxCare] Security Update: libblockdev / libblockdev-crypto / libblockdev-crypto-devel / etc (ALMALINUX9.2:CLSA-2025:1754340109)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754340109 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

Rocky Linux 8.6 [CIQ] Security Update: python3-reportlab / python3-reportlab-debuginfo (ciqsa-2026_0247)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260247 advisory. This advisory aggregates security fixes for the python-reportlab SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2019-19450. Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: python3.12-lxml / python3.12-lxml-debuginfo / etc (crlsa-2026_66203)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202666203 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block direct...

PT-2026-103920

Name of the Vulnerable Software and Affected Versions WatchGuard endpoint security products affected versions not specified Description A missing authentication issue in the Kernel Memory Access Driver PSKMAD allows a local, authenticated attacker to bypass the access-control handshake. This...

Rocky Linux 8.6 [CIQ] Security Update: aide / aide-debuginfo / aide-debugsource (ciqsa-2026_0002)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260002 advisory. This advisory aggregates security fixes for the aide SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2025-54389. Tenable has extracted the preceding description bloc...