398405 matches found
Fedora 43 : openbao (2026-ba51600ab3)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ba51600ab3 advisory. Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86. Tenable has extracted the preceding description block...
TencentOS Server 3: libXfont2 (TSSA-2026:0901)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0901 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
TencentOS Server 3: attr (TSSA-2026:0908)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0908 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
MiracleLinux 8 : kernel-4.18.0-553.153.1.el8_10 (AXSA:2026-1646:66)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1646:66 advisory. kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation CVE-2025-54518 Tenable has extracted the preceding description block...
Oracle Linux 8 : ELSA-2026-60329-0: / mingw-openssl (ELSA-2026-603290)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-603290 advisory. - Fix CVE-2024-5535 SSLselectnextproto buffer overread Resolves: RHEL-45673 Tenable has extracted the preceding description block directly from the Oracle Lin...
SUSE SLES12 Security Update : librest (SUSE-SU-2026:3796-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3796-1 advisory. This update for librest fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically...
TencentOS Server 3: nghttp2 (TSSA-2026:0905)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0905 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
SUSE SLES15 Security Update : kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:3759-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3759-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.166 fixes various security issues: The following security issues were fixed:...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the getminbuffersize function when processing specially crafted video files. An attacker can cause the application to crash by supplying a maliciously crafted video file. Remediation Upgrade ffmpeg to version...
gosentry v0.4.1
gosentry gosentry is a security-focused fork of the Go toolchain, integrating numerous features for state-of-the-art fuzzing campaigns on Go codebases. If you were using go test -fuzz before, you should use gosentry as a replacement. It comes with various fuzzing improvements and bug detectors th...
CVE-2026-80183
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...
CVE-2026-80183
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...
CVE-2026-80183
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with includesubtree to the GET /v3/roleassignments endpoint. The domain's project record has...
CVE-2026-80183
OpenStack Keystone before 29.0.3 is vulnerable to a broken access control flaw in list_role_assignments_for_tree, caused by misuse of "None" in the policy domain_id check. Because a domain's project record stores domain_id=null, any authenticated user holding role:reader on any project can pass a...
Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities
Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-15392 DESCRIPTION: DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The completetablename method builds the...
Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities
Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-43869 DESCRIPTION: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are...
CVE-2026-47842
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...
CVE-2026-26449
In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference or access to invalid memory while processing the frame, causing the process to crash...
CVE-2026-26448
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client or a later connection sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a...
CVE-2026-26449
In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference or access to invalid memory while processing the frame, causing the process to crash...